You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 5 Next »

This page is holding information about requirements for eduroam Managed IdP operations, in terms of required infrastructure and resources.

RESPONSIBLE: Information provided here is initially populated by the development team (during the transition phase), and revised based on the need or in a yearly service check by eduroam Managed IdP Service Manager.

Infrastructure Requirements

Indicate requirements for VMs, grouping the requirements for multiple VMs in one column. Add as many columns as necessary, adding the sensible distinguisher for each group that will make it easier for later reference. 

VM requirementsWeb Frontend
RADIUS
OCSP Responder
Description of usageprovides the web frontend functionality including creation of keys, certificates and OCSP statements.

authenticates EAP sessions.

serves OCSP statements on request of RADIUS
Number of VMs with same specification 121
Hardware requirements (CPU, RAM, disk space) 2 CPU, 1G RAM, 30 GB disk 1 CPU, 512 MB RAM, 30 GB disk1 CPU, 512 MB RAM, 30 GB disk
Network connection requirements

incoming TCP/443 (from world)
outgoing TCP/25 (to world)

SSH to OCSP Responder VM

incoming TCP/2083 (from world)
TCP/80 to OCSP Responder

incoming TCP/80 (from world)
SSH from Web Frontend

IP addressing requirements (IPv4, IPv6, public routable) yes, yes, yesyes, yes, yesyes, yes, yes

Naming requirements1

DNS name: "hosted.eduroam.org" (A/AAAA, plus matching PTR)

DNS name: "auth-1/2.hosted.eduroam.org" (A/AAAA, plus matching PTR)

NAPTR: *.hosted.eduroam.org (wildcard!)
100 10 "s" "x-eduroam:radius.tls" "" _radsec._tcp.hosted.eduroam.org.

SRV: _radsec._tcp.hosted.eduroam.org.
0 0 2083 auth-1.hosted.eduroam.org.
10 0 2083 auth-2.hosted.eduroam.org.

DNS name: "ocsp.hosted.eduroam.org" (A/AAAA, plus matching PTR)
1 Applicable if DNS records maintenance is required (naming scheme and type of records)

Indicate other specific-to-your-service resources requirements. Add as many columns as necessary, adding the sensible distinguisher for each group that will make it easier for later reference. 
Other resource requirementsSMS Gateway
Indicate which ones together with their specifics

needs an account on www.nexmo.com and sufficient funds to send SMSes

account should be created with an email address that is read to receive "low balance" alerts, alternatively enable the feature "Auto reload"

the accounts "key" and "secret" go into the product configuration ( CONFIG_CONFASSISTANT['SMSSETTINGS'] )

Infrastructure hosting requirements

Indicate requirements for infrastructure hosting, scoping by the above indicated infrastructure elements, as necessary. 

 

Hosting requirements

Applying to Web Frontend

Applying to RADIUSApplying to OCSP Responder

Availability

  

Backup (what, frequency, retention period)

  

Monitoring and alerting1

  

Measuring and Reporting2

  

Log retention3

  

Security policy for access and usage4

  

1 At minimum network accessibility (outside of LAN) and hardware resource usage must be monitored. Indicate if some of this resources can be deemed critical so that adequate thresholds for alerting are implemented. Additional, indicate which specific applications uptime and operational health must be monitored and alerting implemented.

2Define what should be measured, how and with what period in order to deliver appropriate reporting relating to KPIs, usage, etc.  

3Define which logs should be kept in order to have debugging data and data in case of misuse of the service, and how long logs should be retained

4Define the policy for limiting accessing to the infrastructure piece and where it should be implemented (system level, network level etc.)

System and Application maintenance requirements

Indicate requirements for system and application maintenance, scoping by the indicated infrastructure elements, as necessary. 

 

System and Application Requirements

Applying to Web Frontend

Applying to RADIUSApplying to OCSP Responder

Operating system

  

Applications1

 Apache 2, PHP7, MariaDB FreeRADIUS 3Apache 2, PHP7
Maintenance hours2  

Configuration management3

  

1 List the applications installed on a system, and add corresponding licenses where applicable.

2 Define window appropriate for regular maintenance. /give some recommendations

3 Applies for automatized configuration management. Describe system used.

Human resources requirements

Indicate requirements both in skills and manpower needed, for personnel needed for devops team (that maintains service specific applications) and for L2 support.

Human resources requirements

add_distinguisher

add_distinguisher

Description

  

Manpower

  
Recommended number of persons (considering backups)  
Skills  

 





  • No labels