The two-factor authentication (2FA) roll-out is now complete for the CERN Single Sign-On, the Linux interactive service (LXPLUS) and the Windows Terminal Server (WTS) gateways (also known as CERNTS). With the addition of the new eduVPN service, all major remote accesses to CERN’s IT services and the CERN Campus network are now properly protected by state-of-the-art technology. While some minor improvements are yet to be completed, e.g. refining the 2FA usage of the LXPLUS fast-track service, LXTUNNEL, the plethora of remote accesses have now been updated (see the image below).
CERN and its Technical Network for accelerator and infrastructure controls require that all interactive logins are 2FA-protected and, with LS3 now under way, the time has come to focus on remote TN access from the internet and from the Campus network [1], [2].
Until recently, remote access to the TN via the centrally managed Linux servers or via personal development virtual machines (VMs) was used only for accelerator operations and was largely unrestricted, using only simple password protection. Now, with the start of LS3, 2FA protections have also been introduced for those accesses (remote WTS access had already been switched to 2FA as part of the general roll-out).
Therefore, over the coming months, the ATS system administration team will only allow remote access to their Linux servers or VMs via the standard 2FA-protected remote access gateways (namely LXTUNNEL, eduVPN or the WTS gateways). In addition, the IT Department has deployed TNPLUS, a new Linux cluster à la LXPLUS. This cluster is dedicated to the TN and complements the TN SWAN notebook service. An alternative access path will remain available to both remote and on-site users via 2FA-protected Remote Operations Gateways (ROGs). Any other human-interactive access path will be blocked [3]. Any non-centrally managed VMs will be restricted to the TN (or converted to become an ATS-managed instance). All VMs and accounts that currently have access will be reviewed and, if their access is unjustified or the challenges meet with silence, they will eventually lose their access rights. Over the course of the next year, some minor adjustments may continue to be made in order to eradicate remaining password-only backdoors and other accesses that deviate from the new standards.
With this, however, the general 2FA strategy has been fully implemented. A big “thank you” to all involved for helping improve the digital protection of CERN and its accelerator complex!
[1] Remote access to the Data Centre management network (IPMI) will not be discussed as it is used by only a small community, limited in access and tightly controlled.
[2] 2FA protection into the experiment networks, in particular those of the LHC experiments, is strongly recommended but, currently, at the discretion of the experiments themselves.
[3] Obviously, the usual automatic access paths via web applications or the GitLab CI environment are not affected as they don’t qualify as “human-interactive”.
_________
Do you want to learn more about computer security incidents and issues at CERN? Follow our Monthly Report. For further information, questions or help, check our websiteor contact us at Computer.Security@cern.ch.