[tech] Clarification of requirements and plan of action

[Paul Fisher]

Hi John,

It's good to hear from you, how are you?

Things have been very busy for us working on the https://unidesk.uwa.edu.au solution.

I've created the ucc.asn.au domain. I was waiting for you to give me one or two pheme accounts that I can have access provisioned.

I see 2 subdomains under uwa.edu.au delegated to ucc.

ucc.guild.uwa.edu.au and ucc.gu.uwa.edu.au, I have created these as subdomains in the account however it is unlikely from the discussion I've had these will be able to be maintained as delegated subdomains.

I've attached the zone files I have for these zones, if you can check these for accuracy. I'll have the records added to the parent zone and delegation removed.

I will confirm a date with you before proceeding.

Moving forward any records under uwa.edu.au are part of the corporate brand and an approval process will be required to have names allocated in the uwa.edu.au domain.


I can see additional domains registered in the 130.95.13.0/24 address space.

didcoe.id.au
shmookey.net
unisfa.asn.au

Are these required moving forward?

>From out discussions we talked about 130.95.13.0/26 being route to the perimeter firewall.

Is this the desired outcome for UCC?

I've attached a network scan for the  130.95.13.0/24 network. Are we in a position to alter the firewall rules from anything about 130.95.13.32/26 now?

Thanks
Paul




________________________________
From: John Hodge <tpg at ucc.asn.au>
Sent: Thursday, 9 April 2020 8:27 AM
To: Paul Fisher <paul.fisher at uwa.edu.au>
Cc: Geoff Costello <geoff.costello at uwa.edu.au>; tech at ucc.asn.au <tech at ucc.asn.au>; wheel at ucc.asn.au <wheel at ucc.asn.au>
Subject: Clarification of requirements and plan of action

Paul,

I haven't seen an update from our discussion several weeks ago, so I thought I'd put to paper some notes and queries about the move towards Cloudflare proxying.

My understanding is that UWA has decided (in response to one of the steps in the ANU data breach) that websites hosted on 130.95.0.0/16 (UWA's IP range) should not be open to the general internet, and instead should be protected by a reverse proxy (in this case, Cloudflare). To this end, DNS is being pointed at Cloudflare (I assume because the DNS service comes with the web proxy service?) and eventually ports 443 and 80 inbound will be closed at the border firewall (with an exception for the Cloudflare proxies).

Queries:

  *   What is the progress on getting access to the Cloudflare dashboard? We would like to start on migration of services before ports 443 and 80 start being blocked.
  *   Are there any other ports (apart from 80/443) that will be blocked at the border?
  *   Is there any progress towards treating 130.95.13.0/24 as "outside" in the core firewall (and thus side-stepping the need to place UCC services behind Cloudflare)?


Examples of services that cannot work with the Cloudflare setup (running both HTTP and non-HTTP on the same hostname):

  *   GitLab (source control server): This runs both a web server (for viewing source code, and managing permissions) and a SSH server (used for uploading code in a secure manner). Neither of these services support DNS "SRV" records (which would permit different IP addresses for HTTP/HTTPS and other services).
  *   "Big Blue Button" (Video conferencing system): This sends its video streams over UDP to a collection of high ports (audio is sent over websockets). This system has been used to great effect by the clubs impacted by the COVID-19 Cameron Hall shutdown, to host their normal events in a virtual space.
  *   We currently have `secure.ucc.asn.au` that "hosts" a whole range of encrypted services (IMAP, POP3, webmail, VPN).


--
John Hodge [TPG]
UCC Wheel Member
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.ucc.gu.uwa.edu.au/pipermail/tech/attachments/20200414/0777713c/attachment-0001.htm 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 130.95.13.0.xlsx
Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
Size: 16022 bytes
Desc: 130.95.13.0.xlsx
Url : https://lists.ucc.gu.uwa.edu.au/pipermail/tech/attachments/20200414/0777713c/attachment-0001.xlsx 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: ucc.guild.uwa.edu.au (1).txt
Url: https://lists.ucc.gu.uwa.edu.au/pipermail/tech/attachments/20200414/0777713c/attachment-0002.txt 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: ucc.gu.uwa.edu.au (1).txt
Url: https://lists.ucc.gu.uwa.edu.au/pipermail/tech/attachments/20200414/0777713c/attachment-0003.txt