Updates from France. Migration of the CRU federation Setting up a national anti-spam service. 4 th December

Transcription

1 Updates from France Migration of the CRU federation Setting up a national anti-spam service 4 th December

2 Migration of the CRU federation The CRU federation Running since January 2006 Successful service 55 identity providers...covering students (=53%) 57 federated resources However extension is needed to cover research institutes (CNRS, INRIA,...) other HiEd institutions (private or belonging to other ministries) CRU federation => RENATER federation 4 th December

3 Migration of the CRU federation The roadmap 4 th December

4 Migration of the CRU federation What changes? Extended perimeter New notions Member organizations Partner organizations New terminology Service provider => resource News documents Charters for members and partners A technical framework 4 th December

5 Migration of the CRU federation Registration process Federation participant either Organisation member of the federation (organisation having a RENATER agreement) or Organisation partner of the federation (any type of organisation) declares one Identity provider declares one or more Resource Resource Resource Resource declares one or more 4 th December

6 Migration of the CRU federation The technical framework Supported software Shibboleth 1.3 and shibboleth 2.0 Supported profiles SAML 1.1 and SAML 2.0 with attribute push (no more SOAP callback) no more CAs in metadata (in-line certs) Naming of entities (recommendation) Use URLs instead of URNs for IdPs th December

7 Migration of the CRU federation The RENATER federation The web site : 4 th December

8 Why? >90% of mail traffic is Spam Each university (200+) manage their own anti-spam protection Requires lots of tuning and expertise => requires significant human resources Poor results still too many spams false positives delays (grey-listing) Growing interest for anti-spam appliances 4 th December

9 The project Setting up a national service Operated by RENATER + CRU Using a cluster of anti-spam appliance servers Client organizations need to Change their MX Provide an access to an LDAP directory 4 th December

10 The architecture National anti-spam cluster... appliance appliance appliance MX DNS entry for Univ. X Yes know recipient? MTA LDAP directory University X 4 th December

11 Appliance-based Anti-spam appliance solutions Barracuda, Ironport, Mirapoint, Sendmail, Trend Micro,... Benefits Precise and efficient anti-spam filtering Reputation control instead of grey-listing Can cope with high load Include anti-virus solutions Delegation features (admin interface) LDAP connectors 4 th December

12 A set of criteria Economical References Filtering quality Scalability Administration Load management Filtering customization (via LDAP) Logs quality Features (BATV, S/MIME, DKIM,...) 4 th December

13 Copping with backscatters Principle A forges B identity A sends spam to C C sends non-delivery reports to A Loop (until mail server crashes) Backscatters can be avoided rejecting User Unknown on the front door thus notifying the true sender the front server needs to know valid users Anti-spam appliances context Query an LDAP directory for each domain 4 th December

14 The Pilot service Starts on 5 th January 2008 quick start because it's time to 200 domains (10 different organizations) mail boxes Anti-virus optional expensive No quarantine difficult to cope with No outgoing filtering can't afford to be black-listed 4 th December

15 Ask the expert: Similar projects in your country? 4 th December