Versions Compared

Old Version 17

changes.mady.by.user Stefan Winter

Saved on

compared with

New Version 18

changes.mady.by.user Miroslav Milinović

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

1 Applicable if DNS records maintenance is required (naming scheme and type of records)

Indicate other specific-to-your-service resources requirements. Add as many columns as necessary, adding the sensible distinguisher for each group that will make it easier for later reference. 
Other resource requirementsSMS Gateway
Indicate which ones together with their specifics

needs an account on www.nexmo.com and sufficient funds to send SMSes

account should be created with an email address that is read to receive "low balance" alerts, alternatively enable the feature "Auto reload"

the accounts "key" and "secret" go into the product configuration ( CONFIG_CONFASSISTANT['SMSSETTINGS'] )

Infrastructure hosting requirements

Indicate requirements for infrastructure hosting, scoping by the above indicated infrastructure elements, as necessary. 

 

Hosting requirements

Applying to Web Frontend

Applying to RADIUSApplying to OCSP Responder

Availability

 99.9%

99.999% for the cluster as a whole

NAPTR/SRV records make sure that uptime is assured if at least 1 server is up

99.9%

Backup (what, frequency, retention period)

What: database contents, product configuration, product logs

Frequency: once per day

Period: 1 month

server configuration, authentication log

Frequency: hourly

Period: 6 months (this is recommendation of eduroam Service Definition)

Apache configuration, content of OCSP directory

Frequency: hourly

Period: 1 month

Monitoring and alerting1

IPv4 and IPv6 reachability

HTTPS on IPv4 and IPv6

MariaDB server running?

memory and disk usage

IPv4 and IPv6 reachability

RADIUS process (Status-Server via RADIUS/TLS; needs Icinga monitoring script)

memory and disk usage

IPv4 and IPv6 reachability

HTTP on IPv4 and IPv6

memory and disk usage

Measuring and Reporting2

number of institutions enrolled, monthly

number of eduroam credentials created, monthly

(both figures can be read from UI, cumulative; automated SQL queries can be crafted upon request)

 N/AN/A

Log retention3

for each month, 1 of the database backups should be retained "forever"

product logs should be retained for 6 months

 6 months (this is recommendation of eduroam Service Definition)not needed (1 day for debugging)

Security policy for access and usage4

The log and database should be accessible only to OT personnel.

There is next to no PII in the log files or database - limited to ePTID of administrators and local (opaque) identifiers of end users. They can only be traced back to actual humans with out-of-band processes involving the IdP administrator in person.

The authentication logs should be accessible only to OT personnel.

They contain pseudonyms of the local (opaque) identifiers of end users. They can only be traced back to actual humans with out-of-band processes involving the IdP administrator in person.

The authentication logs should be accessible only to OT personnel.

They contain pseudonyms of the local (opaque) identifiers of end users. They can only be traced back to actual humans with out-of-band processes involving the IdP administrator in person.


1 At minimum network accessibility (outside of LAN) and hardware resource usage must be monitored. Indicate if some of this resources can be deemed critical so that adequate thresholds for alerting are implemented. Additional, indicate which specific applications uptime and operational health must be monitored and alerting implemented.

2Define what should be measured, how and with what period in order to deliver appropriate reporting relating to KPIs, usage, etc.  

3Define which logs should be kept in order to have debugging data and data in case of misuse of the service, and how long logs should be retained

4Define the policy for limiting accessing to the infrastructure piece and where it should be implemented (system level, network level etc.)

System and Application maintenance requirements

Indicate requirements for system and application maintenance, scoping by the indicated infrastructure elements, as necessary. 

 

System and Application Requirements

Applying to Web Frontend

Applying to RADIUSApplying to OCSP Responder

Operating system

 RHEL / CentOS 7RHEL / CentOS 7RHEL / CentOS 7

Applications1

 Apache 2, PHP7, MariaDB, haveged FreeRADIUS 3Apache 2, PHP7
Maintenance hours2

 product is used world-wide - there is never a good time

any time so long as one cluster member remains in service at all timesany time

Configuration management3

currently none (Git desirable)currently none (Git desirable)currently none (Git desirable)

 

1 List the applications installed on a system, and add corresponding licenses where applicable.

2 Define window appropriate for regular maintenance. /give some recommendations

3 Applies for automatized configuration management. Describe system used.

Human resources requirements 

Indicate requirements both in skills and manpower needed, for personnel needed for devops team (that maintains service specific applications) and for L2 support.

Description

Manpower

Recommended number of persons (considering backups)
Skills
Operations FTE, inc CSI 0.2 FTE 2TBCeduroam OT member
1st level support (production)0.2 FTE max. 50 tickets per month. Estimate 30 mins per ticket, so 25 hours per month = roughly just under 0.2 FTE 2TBCGEANT FLS

2nd level support (production)0.1 FTE. Estimate 10% of L1 tickets escalated, so 5 tickets per month at 2 hours per ticket. 2TBCeduroam OT member / development team member

Service mgr for production (the contracts with participating NRENs etc.) 0.1 FTE 1Miro!eduroam SM