SCEPP Internet Information
What does SCEPP need from from the Internet coordinator?
We need a static IP number for the data acquisition computer, which is provided, configured, and maintained by USC. We also need for your firewall to be configured to allow two way traffic to and from our servers at USC. In most firewall-protected networks, this requires that we receive TWO IP numbers: first, a static number on the interior of the firewall and second, a "routable" static IP number that we access from the outside world. Your firewall must then be configured to pass packets arriving for the outside IP number to the inside IP number. We will also need an Ethernet connection within a reasonable distance of the SCEPP computer.
What machines will access the SCEPP computer?
The only machines outside of the high school that will access it are our two servers, pooh.seis.sc.edu (129.252.35.24) and piglet.seis.sc.edu (129.252.35.10). We may eventually allow some access to the data from machines within the high school to avoid network delays, but that will be totally within your firewall.
Why does it have to be static, what about DHCP?
We need both connections from the SCEPP computer to our server and from our server to the SCEPP computer in the high school. Without a static IP number we would not have a reliable way for our central server to find all of the SCEPP computers in the various high schools.
What about security on this computer?
The SCEPP computer will be a PC running Linux. We will configure each system so that it has no active services except ssh (secure shell) and ntp (network time protocol) and of course the data movement services. Also, only the SCEPP staff will have passwords for the machine, neither the teachers or students will have any reason to directly log on. Thus, these machines should be extremely secure. Secure shell is needed to allow us to access the computer for remote administration. More information on it can be found at www.ssh.org and at the SSH FAQ. NTP keeps the clock on the PC from drifting by synchronizing it to another computer's clock. More information can be found at www.ntp.org.
Does SCEPP need anything special from my firewall?
Possibly. The data acquisition computer will need both in and out-bound connections for the ssh port (22 TCP) and both in and out-bound for the ntp port (123 UDP) to USC's server. In other words, pooh must be able to open a TCP socket from all high numbered ports to port 22 on the SCEPP PC and the SCEPP PC must be able to open a TCP socket from all high numbered ports to port 22 on pooh. The SCEPP PC must also be able to send and receive UDP packets to/from port 123 on pooh. Lastly, the actual seismic data delivery software uses TCP sockets on high numbered ports to deliver the data. These ports are chosen at random and cannot be predicted in advance. So, the SCEPP PC will need to be able to open a TCP socket to all high numbered ports on pooh as well as accept high numbered socket connections from pooh. The same needs apply to piglet, which is our backup server.
We have a pdf document that shows the rules that some schools have used. This was created by a school that used Novell BorderManager, and so some of the terms used may be different, but the concepts should be similar.
Also, the software that we are giving to teachers to use in the computer labs in the schools needs to be able to make a TCP socket connection back to pooh to get the data in a manner similar to the SCEPP PC. These are also high numbered ports that are chosen at random each run. Therefore, the firewall needs to be configured to allow all high numbered TCP socket connection from any machine in the schools to all high numbered ports on pooh and piglet.
What will you do to keep smart kids with bootable floppies at bay?
Well, hopefully they will become so interested in seismology that they won't have time to play at cracking into school computers. In case our first idea isn't completely successful, we plan on using hardware password protection on the PCs so that they will only boot from the internal hard drive. They will also be installed headless, ie without a monitor or keyboard attached. Lastly, we will make an effort to choose a secure location for the SCEPP PC, such as a service closet or teacher's office, so that students would not have direct access to it.
What about security on the server at USC?
Pooh is a Sun Enterprise 450 running Solaris7. We have turned off all unneeded services including smtp, telnet, ftp, rsh. It is only accessible via ssh (secure shell) and uses the apache web server. Patches from Sun are applied both on a regular basis and whenever a new security alert is issued by Sun. Only the SCEPP staff members have access to Pooh.
Will this take up a lot of my limited bandwidth?
The seismometer system will likely be sampling at 20 samples per second. With all three channels it will generate about 20 Mb per day total, but this is spread evenly over the day and so the rate is insignificant in comparison with the load created by web surfing. We will also use compression which typically reduces the volume by a factor of 3 to 5. For comparison, this is equivalent to less than half of the bandwidth of a 1200 baud modem.
Please contact Philip Crotwell you have any further questions.