Overview

• Introduction
• Current State
  • Design
  • General Flow
  • Functionalities
  • Observations
• The Road Ahead

Introduction

Software package designed to

• run Communications Challenges
• by sending challenge mails to participants (sites)
• and tracking their response times.
• Originally developed for EGI CSIRT back in the day.

Current State: Design

• Two components:
  • createMails.py: assembles and sends challenge mails,
  • reaction.py: provides a web service to keep track of response times etc.

Current State: Design – createMails.py

• Runs on $MACHINE (doesn’t really matter – call it “client”);
• takes two input files:
  • list of participants (sites) to be challenged, and
  • mail template;
• walks through the input list, and for each item
  • creates a unique hash,
  • assembles a unique mail for the participant,
  • sends the mail, and
  • calls the create function on the server part.

Current State: Design – reaction.py

• Runs on a web server (for instance, challenge.edugain.org),
• design goal: minimal attack surface (386 LoC, stand-alone),
• provides multiple functionalities:
  • create a target site (participant record),
  • record a site’s response time (using a CAPTCHA challenge),
  • provide the results of a challenge run
    • as an HTML table,
    • as a CSV file, or
    • as a graph in multiple formats.

Current State: General Flow

To conduct a challenge run, these steps are required:

1. (Set up a web server for the server component.)
2. Create a directory for the challenge run on the web server.
3. Prepare the input file with site contacts and the mail template.
4. Send the challenge mails.
5. Create the file .INITIALIZED on the web server.
6. Sit back.
7. Create the file .LOCKED on the web server.
8. Enjoy the results.

Current State: General Flow – Cont’d

–

Current State: General Flow – Cont’d

Current State: Advanced Timing

Current State: Signatures

• Two flavors: GPG/MIME and S/MIME.
• Thus, three potential backends:
  • GnuPG: Works (AFAICT),
  • GPGSM: Works (AFAICT),
  • OpenSSL: Not supported yet (interfaces exist already).
• Cryptographic signatures are sneaky bastards:
  • Need to get the privated key unlocked somehow (agent, passphrase, whatever),
  • signatures have timestamps.

Current State: Web-Server Functionality

General URL format: ${SERVER}/${CAMPAIGN}-{SITE}.

Web server supports a number of functions:

• ${URL}/create: Initialize the timer for a given challenged site,
• ${URL}/results: Get the current results for the challenge,
• ${URL}/csv: Get the current results as CSV file,
• ${URL}/graph: Get the current results in graph form,
• ${URL}/latex: Get the graph as LaTeX code,
• ${URL}/run: Declare the initialization to be finished.

No command to create or to close challenges: out-of-band!

Current State: Getting Results

• CSV and HTML output are “static”.
• Graphs can be tweaked. For example:
  • Auto re-load: Add ?refresh=30 to reload every 30 seconds.
  • File format: Add ?format=jpg to get JPG (or PDF or PNG or SVG) output.
  • Thresholds: Add ?threshold=12 to add a (vertical) mark at 12 hours and the relevant statistics.
  • Percentages: Add ?percentage=50 to add a (horizontal) mark at 50 percent.

Current State: Observations

• Sites whine about the challenge. Always.
  • Mails not signed,
  • mails look wrong,
  • mails contain URLs,
  • the web page looks wrong,
  • the process feels like phishing,
  • …
• Generally, we get reactions from around 80 % of sites.

The Road Ahead

• Open Issues:
  • Allow re-sending individual mails;
  • make input file format flexible.
• Other potential ideas?
  • Allow explicit waiting time between mails?
  • Web-page templating?

Questions? Answers!

Thank you for your attention! Discuss! :-)