CalNetAD Planning Committee

March 17, 2006

2195 Hearst, 200C Conference Room, 11:00AM-12:00 PM

Updated: 03/20/2006

Agenda

1. Windows Server Update Services (John Weber/John Ives)

2. Encrypted File Services (John Weber)

3. DNS Changes (John Weber)

4. Upcoming Password Changes (Mike Blasingame/Karl Grose)

5. Other Business

Notes

Windows Server Update Services

WSUS was put into production on March 1, and SUS has been decommissioned. The same schedule will be used in approval of the patches. For more information, go to http://update.berkeley.edu

John Ives from SNS will be using the WSUS data to help merge data with other patching data SNS now collects. OU admins can also receive emails from SNS to see which of their machines are being patched. Contact the CalNetAD team for more info.

Encrypted File Services

A draft Key Management Plan for CalNetPKIs use of EFS is now available on http://calnetpki.berkeley.edu. Remember that encryption should be used only as a "last resort" where the local storage of restricted data is essential.

DNS Changes

CNS will be changing the ACLs on the campus.berkeley.edu and uc.berkeley.edu domains to make them not visible via DNS from off Campus. That should solve the slow logons mobile users have been experiencing from off campus (due to the border block on 135-139 and 445). All off campus users are strongly encouraged to use the Cisco VPN client available for free at http://software.berkeley.edu.

CNS will also be disabling recursion from off campus users in the summer. This will prevent any non-campus address from using ns1.berkeley.edu or ns2.berkeley.edu as DNS servers for clients.

Upcoming Password Changes

The MIT and CalNetAD Kerberos realms are planned to be merged, with CalNetAD becoming the authoritative KDC for the Berkeley Campus. This transition will take place gradually, and the CalNet and CalNetAD teams hope to have a password synchronization method in place by Summer 2006.

OU admins should consider becoming deputies since they will lose the ability to reset pass phrases, since "shadow" accounts will become CalNet accounts. All pass phrase changes will be forced to go through the CalNet web applications (i.e. deputy reset or self service change; no CTRL-ALT-DEL pass phrase changes), at least during the transition.

Other Business

Next meeting in approximately 3 months.