[committee] Fwd: Re: UCC Services and UWA's implementation of Cloudflare
James Arcus (21954943)
21954943 at student.uwa.edu.au
Tue Mar 24 13:46:31 AWST 2020
FYI for all.
Tim, Nick, John, Bob: who of you are available tomorrow @ 3pm?
Cheers,
James [MPT]
-------- Forwarded Message --------
Subject: Re: UCC Services and UWA's implementation of Cloudflare
Date: Tue, 24 Mar 2020 13:24:41 +0800
From: Geoff Costello <geoff.costello at uwa.edu.au><mailto:geoff.costello at uwa.edu.au>
To: James Arcus <james.arcus at uwa.edu.au><mailto:james.arcus at uwa.edu.au>, James Arcus (21954943) <21954943 at student.uwa.edu.au><mailto:21954943 at student.uwa.edu.au>
CC: Steven Lim <steven.lim at uwa.edu.au><mailto:steven.lim at uwa.edu.au>, Jack Bryant <Jack.Bryant at uwa.edu.au><mailto:Jack.Bryant at uwa.edu.au>, Phil Norris <phil.norris at uwa.edu.au><mailto:phil.norris at uwa.edu.au>, Paul Fisher <paul.fisher at uwa.edu.au><mailto:paul.fisher at uwa.edu.au>, Matthew DeGois <matthew.degois at uwa.edu.au><mailto:matthew.degois at uwa.edu.au>
James - Thanks for responding to the ticket, I have sent you a invite for a Teams meeting tomorrow @ 3pm. I will separately forward you a more detailed email I sent earlier today to the UCC email address, that explains the planned way forward in more detail.
Geoff Costello
Programme Architect
University Information Technology • M463, Perth WA 6009 Australia
M +61 0415 554 819 • E geoff.costello at uwa.edu.au<mailto:scott.obrien at uwa.edu.au>
[cid:image001.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Fuwa-logo%2F&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7C8fd54b54e25e44d3697908d79e4837f7%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637151905320694195&sdata=CSWWHGNNt2VtYZmmbvXpUVtZCiSY3%2FG%2BLqLX9rVc%2Fis%3D&reserved=0>
[cid:image002.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Fpursue&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7C8fd54b54e25e44d3697908d79e4837f7%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637151905320704182&sdata=oXQKKQ9EZZBan6WyBCtgcBQCiYWtcQgzJtMa24dB%2BVk%3D&reserved=0>[cid:image003.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Ffacebook&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7C8fd54b54e25e44d3697908d79e4837f7%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637151905320704182&sdata=tn6yoma0OTSpF22f7vyv0vJMeoNsXFujizZvmo0xQA4%3D&reserved=0>[cid:image004.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Ftwitter&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7C8fd54b54e25e44d3697908d79e4837f7%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637151905320714180&sdata=9gKJcgedeV5eRvhgZb6NePGqrSKVIgTpob75Mcy1s2s%3D&reserved=0>[cid:image005.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Fyoutube&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7C8fd54b54e25e44d3697908d79e4837f7%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637151905320714180&sdata=o7qwRG1PmQWB24OXMlqpe5Z%2B7ufKzDWbVcJD9iq6jCE%3D&reserved=0>
________________________________
From: Matthew DeGois <matthew.degois at uwa.edu.au><mailto:matthew.degois at uwa.edu.au>
Sent: Tuesday, 24 March 2020 12:41 PM
To: Geoff Costello <geoff.costello at uwa.edu.au><mailto:geoff.costello at uwa.edu.au>; Paul Fisher <paul.fisher at uwa.edu.au><mailto:paul.fisher at uwa.edu.au>
Cc: Steven Lim <steven.lim at uwa.edu.au><mailto:steven.lim at uwa.edu.au>; Jack Bryant <Jack.Bryant at uwa.edu.au><mailto:Jack.Bryant at uwa.edu.au>; Phil Norris <phil.norris at uwa.edu.au><mailto:phil.norris at uwa.edu.au>
Subject: RE: UCC Services and UWA's implementation of Cloudflare
Hi Geoff,
I received the following response from the ticket that was lodged.
Hi Matt,
I, along with some of my colleagues, are eager to discuss the changes
further and work together to find the best solution for both groups.
My availability is good for any time tomorrow, Thursday after 2pm and
Friday after 12pm. Do any of those times work for you?
Due to the current situation with Coronavirus, is there a preferred
conference call solution for a meeting?
Cheers,
James Arcus
/UCC President/
I think we will need reps from each of the teams to determine if what they want is what we want to offer.
Cheers,
Matt.
Matthew De Gois
Lead – IT Service Delivery Improvement
Uni IT • M209, Perth WA 6009 Australia
T +61 8 6488 1190 • E it-servicedesk at uwa.edu.au<mailto:it-servicedesk at uwa.edu.au>
From: Geoff Costello <geoff.costello at uwa.edu.au><mailto:geoff.costello at uwa.edu.au>
Sent: Tuesday, 24 March 2020 12:00 PM
To: Matthew DeGois <matthew.degois at uwa.edu.au><mailto:matthew.degois at uwa.edu.au>; Paul Fisher <paul.fisher at uwa.edu.au><mailto:paul.fisher at uwa.edu.au>
Cc: Steven Lim <steven.lim at uwa.edu.au><mailto:steven.lim at uwa.edu.au>; Jack Bryant <Jack.Bryant at uwa.edu.au><mailto:Jack.Bryant at uwa.edu.au>; Phil Norris <phil.norris at uwa.edu.au><mailto:phil.norris at uwa.edu.au>
Subject: Fw: UCC Services and UWA's implementation of Cloudflare
Matthew and Paul,
Thanks for the feedback. I note that the Student Guild's phone number is 6488 2295 - I recommend one of you call them about this? if not would you like me to call to get a contact?
Geoff Costello
Programme Architect
University Information Technology • M463, Perth WA 6009 Australia
M +61 0415 554 819 • E geoff.costello at uwa.edu.au<mailto:scott.obrien at uwa.edu.au>
[cid:image001.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Fuwa-logo%2F&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7Cdbea227c8e13444c5f3308d7cfad9bc5%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637206216852397080&sdata=xHAlYhQzxjxW6GULMVUnbeC2%2BqovqB2qhI63ByNSRLY%3D&reserved=0>
[cid:image002.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Fpursue&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7Cdbea227c8e13444c5f3308d7cfad9bc5%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637206216852407079&sdata=0%2FqNvB9fXvst6jJMXv7lf%2FoBCFt9sUu5I45sQWCzKak%3D&reserved=0>[cid:image003.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Ffacebook&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7Cdbea227c8e13444c5f3308d7cfad9bc5%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637206216852417070&sdata=NHzNjwo2rRcw4zrBKkvPpM70lvqrCBNWn6OmuEldQjE%3D&reserved=0>[cid:image004.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Ftwitter&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7Cdbea227c8e13444c5f3308d7cfad9bc5%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637206216852417070&sdata=dDeCUFGJbJqqQupTZuyA8RX6eXx%2BkQFiC3E39wbkJXo%3D&reserved=0>[cid:image005.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Fyoutube&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7Cdbea227c8e13444c5f3308d7cfad9bc5%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637206216852427069&sdata=%2BNCHWBH34PesJF23YziECIQiZYoOknRmV3dzoliLN4s%3D&reserved=0>
________________________________
From: Matthew DeGois <matthew.degois at uwa.edu.au<mailto:matthew.degois at uwa.edu.au>>
Sent: Tuesday, 24 March 2020 10:31 AM
To: Geoff Costello <geoff.costello at uwa.edu.au<mailto:geoff.costello at uwa.edu.au>>
Cc: Steven Lim <steven.lim at uwa.edu.au<mailto:steven.lim at uwa.edu.au>>; Paul Fisher <paul.fisher at uwa.edu.au<mailto:paul.fisher at uwa.edu.au>>; Phil Norris <phil.norris at uwa.edu.au<mailto:phil.norris at uwa.edu.au>>; Jack Bryant <Jack.Bryant at uwa.edu.au<mailto:Jack.Bryant at uwa.edu.au>>
Subject: RE: UCC Services and UWA's implementation of Cloudflare
Thank you Geoff. Apologies I was not able to send this out in time. I was drafting the email but with all the COVID stuff going on, Service Delivery is getting hammered with requests and escalations. The 50/50 split of staff doesn’t help.
You worded it better than I would have anyway :)
Cheers,
Matt.
Matthew De Gois
Lead – IT Service Delivery Improvement
Uni IT • M209, Perth WA 6009 Australia
T +61 8 6488 1190 • E it-servicedesk at uwa.edu.au<mailto:it-servicedesk at uwa.edu.au>
From: Geoff Costello <geoff.costello at uwa.edu.au<mailto:geoff.costello at uwa.edu.au>>
Sent: Tuesday, 24 March 2020 10:27 AM
To: wheel at ucc.asn.au<mailto:wheel at ucc.asn.au>; committee at ucc.asn.au<mailto:committee at ucc.asn.au>
Cc: Matthew DeGois <matthew.degois at uwa.edu.au<mailto:matthew.degois at uwa.edu.au>>; Steven Lim <steven.lim at uwa.edu.au<mailto:steven.lim at uwa.edu.au>>; Paul Fisher <paul.fisher at uwa.edu.au<mailto:paul.fisher at uwa.edu.au>>; Phil Norris <phil.norris at uwa.edu.au<mailto:phil.norris at uwa.edu.au>>; Jack Bryant <Jack.Bryant at uwa.edu.au<mailto:Jack.Bryant at uwa.edu.au>>
Subject: UCC Services and UWA's implementation of Cloudflare
Attention: John Hodge and UCC committee
A week ago, you put in a service desk ticket regarding why resolving the domain `mooneye.ucc.gu.uwa.edu.au` via a recursive lookup returns Cloudflare’s IPs instead of 130.95.13.9.
This is because UWA has moved all its domain hosting to Cloudflare.com and is in the process of protecting all web servers and computers exposed to the internet with the wide range security features available for paid domain hosting.
During the week between Monday 30 March and Friday 3 April, we plan to lock down the services in the network segment used to host servers for the Guild and UCC so that the only external access is via Cloudflare as a DNS and internet protection service. This is essential as each server exposed to the internet represents a target for a broad range of cyber attacks such as the one that impacted the ANU last year.
Please reply to this email urgently with your contact details so we can work with you to address any issues that may disrupt the operation of important UCC services. We want to work with you to make the transition as smooth as possible.
Implications for UCC Services
The following summarises what this means to the UCC services.
* UCC Services that are subdomains of ucc.gu.uwa.edu.au – These already have the DNS hosted by Cloudflare (as per your service ticket). We will be enabling SSL certificates and Cloudflare security services for these in the same way as for any other UWA subdomain.
* UCC Services that are subdomains of ucc.asn.au – The DNS for this domain appears to be hosted on the mooneye server and point to server IP address in the UWA address space. In short, we will be blocking access the mooneye DNS server, and would like to move the DNS hosting for the domain ucc.asn.au to Cloudflare using their “Pro” account to protect services on that domain. This will allow UWA to secure traffic to services for ucc.an.au, while still giving the UCC the flexibility to create subdomains as needed within the ucc.asn.au space. New sub-domains can be created as required via a service request to University IT. More instructions and information on how to rehost the DNS for ucc.asn.au in Cloudflare are given below.
* Public DNS hosted on mooneye.ucc.gu.uwa.edu.au -This will be blocked from internet access as Cloudflare will be the only DNS service supported allowing access into servers hosted on the UWA network.
* If there are any sites on this related to UWA operations (including the student guild), please let us know urgently so we can put in place arrangements to have the DNS hosted by Cloudflare and traffic protected by Cloudflare.
* Information on other services is covered below.
* Other External Domains pointing at UWA Servers - There are a number of external services such as experiments.tecosaur.com that are hosted on servers operating in UWA’s address space. Some of these are have their DNS records hosted in external services such as namecheap.com, others appear to have their DNS records hosted on mooneye.ucc.gu.uwa.edu.au. Many of these sites appear to be legacy sites and potentially inactive, however each represent a security exposure as traffic is being allowed into these sites to UWA’s servers. External access to these servers will be blocked, unless they can be justified as a UWA related organisation, in which case their DNS hosting needs to be moved to Cloudflare under a pro account, as per Guild and Affiliate Sites, or a UCC related site, in which care the site needs to become a subdomain of ucc.asn.au.
* If there are any UCC related sites on other domains that require continued external access please let us know urgently so we can put in place arrangements to have the DNS hosted by Cloudflare and traffic protected by Cloudflare, either as part of ucc.asn.au or (in special circumstances) its own domain.
* Legacy non UWA related Services – There appear to be a number of legacy non UWA services with external access that are hosted on UWA servers via a series of IP addresses in the Guild / UCC segment of the UWA IP range. Access to these services will be deactivated unless there is a legitimate UWA related requirement, in which case we need to move them to a UWA controlled protected DNS and Cloudflare account. While most of these services appear to be legacy and inactive, if there are non UWA externally facing services are still required by their operators, both the DNS and the hosting for these need to be moved to one of many external hosting services before Friday 3 April when access will be suspended.
Guild Services
Please note we have separately contacted the UWA Guild over the DNS for UWAstudentguild.com and any other guild services to ensure they are also migrated to Cloudflare for protection.
Rehosting the DNS for ucc.asn.au in Cloudflare
Rehosting the DNS for ucc.asn.au in Clouflare is as simple as:
1. Confirming with Paul Fisher (paul.fisher at uwa.edu.au<mailto:paul.fisher at uwa.edu.au> 0420 755 194) that you are ready to move the DNS to Cloudflare and he will have the DNS entries setup in advance for you in Cloudflare.
2. Logging in to your current domain registar
3. Removing the current name servers:
* ns1.dnspackage.com
* ns2.dnspackage.com
* ns3.he.netns2.afraid.org
* ns2.he.netns4.he.net
* mooneye.ucc.gu.uwa.edu.au
1. Replacing with:
* ainsley.ns.cloudflare.com
* carter.ns.cloudflare.com
1. Saving your changes
We will then work to implement security protections against things like Denial of service and cyber attacks on uwastudentguild.com
If you have any questions on this process, please get back to Paul Fisher or Matthew DeGois.
The ucc.gu.uwa.edu.au domain will be protected by Cloudflare anyway as we have control over all subdomains in uwa.edu.au.
Summary and Conclusion
We trust you understand the need for appropriate cyber security protections for all internet exposed services on the UWA network. An attack on a single server could potentially compromise significant parts of the network, so we need o ensure that only authorised services are exposed to the internet and they are all appropriately protected. We need to complete this transition by Friday 3 April, and want to work with you to make this a smooth process.
We apologise for any effort this may require, but we believe the proposed approach will still allow the UCC to operate and provide effective services to its many members.
Regards
Geoff Costello
Programme Architect
University Information Technology • M463, Perth WA 6009 Australia
M +61 0415 554 819 • E geoff.costello at uwa.edu.au<mailto:scott.obrien at uwa.edu.au>
[cid:image001.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Fuwa-logo%2F&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7Cdbea227c8e13444c5f3308d7cfad9bc5%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637206216852427069&sdata=355KuUvzxRqQGeCPN4%2BOZRNiljq%2Fq6NMztnqCU4HRdc%3D&reserved=0>
[cid:image002.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Fpursue&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7Cdbea227c8e13444c5f3308d7cfad9bc5%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637206216852437060&sdata=prGdAO3ZgspU7tB0IWtnCOrV7WQVtTjOMCIWFdKQjE8%3D&reserved=0>[cid:image003.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Ffacebook&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7Cdbea227c8e13444c5f3308d7cfad9bc5%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637206216852437060&sdata=JhmV27UcUx4FGN86mA2dcSf2rtHSivHQxtN1MxbZBxU%3D&reserved=0>[cid:image004.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Ftwitter&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7Cdbea227c8e13444c5f3308d7cfad9bc5%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637206216852447047&sdata=sSa4EGocpYqpMomzTlIwlQDn9KOvhKPNByC8X6cbDtI%3D&reserved=0>[cid:image005.gif at 01D38872.AA7E75A0]<https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.uwa.edu.au%2Funiversity-campaigns-resources%2Femailsig2015%2Fyoutube&data=02%7C01%7Cgeoff.costello%40uwa.edu.au%7Cdbea227c8e13444c5f3308d7cfad9bc5%7C05894af0cb2846d8871674cdb46e2226%7C1%7C0%7C637206216852447047&sdata=Lrllvu4pN75AuvsO8xpzYqpeuwkviUn3Mg1pJuPDJ%2F8%3D&reserved=0>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ucc.gu.uwa.edu.au/pipermail/committee/attachments/20200324/a938f03d/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-cid_image0.png
Type: image/png
Size: 12885 bytes
Desc: Outlook-cid_image0.png
URL: <https://lists.ucc.gu.uwa.edu.au/pipermail/committee/attachments/20200324/a938f03d/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-cid_image0.png
Type: image/png
Size: 5028 bytes
Desc: Outlook-cid_image0.png
URL: <https://lists.ucc.gu.uwa.edu.au/pipermail/committee/attachments/20200324/a938f03d/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-cid_image0.png
Type: image/png
Size: 915 bytes
Desc: Outlook-cid_image0.png
URL: <https://lists.ucc.gu.uwa.edu.au/pipermail/committee/attachments/20200324/a938f03d/attachment-0002.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-cid_image0.png
Type: image/png
Size: 1046 bytes
Desc: Outlook-cid_image0.png
URL: <https://lists.ucc.gu.uwa.edu.au/pipermail/committee/attachments/20200324/a938f03d/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-cid_image0.png
Type: image/png
Size: 1672 bytes
Desc: Outlook-cid_image0.png
URL: <https://lists.ucc.gu.uwa.edu.au/pipermail/committee/attachments/20200324/a938f03d/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 12885 bytes
Desc: image001.png
URL: <https://lists.ucc.gu.uwa.edu.au/pipermail/committee/attachments/20200324/a938f03d/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 5028 bytes
Desc: image002.png
URL: <https://lists.ucc.gu.uwa.edu.au/pipermail/committee/attachments/20200324/a938f03d/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 915 bytes
Desc: image003.png
URL: <https://lists.ucc.gu.uwa.edu.au/pipermail/committee/attachments/20200324/a938f03d/attachment-0007.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image004.png
Type: image/png
Size: 1046 bytes
Desc: image004.png
URL: <https://lists.ucc.gu.uwa.edu.au/pipermail/committee/attachments/20200324/a938f03d/attachment-0008.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image005.png
Type: image/png
Size: 1672 bytes
Desc: image005.png
URL: <https://lists.ucc.gu.uwa.edu.au/pipermail/committee/attachments/20200324/a938f03d/attachment-0009.png>
More information about the committee
mailing list