Comment on Setting up a server for a research team. What should be in my checklist?
1995ToyotaCorolla@lemmy.world 1 day ago
I guarantee that if your university IT department knows nothing of this they will not appreciate a shadow IT device set up on their network when they find it. And they WILL find it. Reach out to your school’s IT team and make sure your research team has approval to do this before proceeding
Source: worked in Higher Ed IT
bergetfew@sopuli.xyz 1 day ago
They already have gotten the permission for this.
However the IT department wouldn’t be helping with enabling public access to the computer via the university’s intranet. So it is up to me to figure out an alternative connection strategy like tunneling or VPN.
1995ToyotaCorolla@lemmy.world 1 day ago
I might double check if you’re taking the research team’s word for it. It’s very strange to me that IT won’t help with setting up remote access, especially if you’re doing something like setting up a tunnel that would likely bypass their firewall rules and network monitoring. If anyone compromises your tunnel and are able to access education, financial, or health records with it, your IT team and you will be in very hot water. I’ve had to set up remote access for research projects before, and that involved site-to-site tunnels between participating campuses. These always run on the university’s VPN infrastructure, you’re not going to be rolling your own talescale or wireguard to do this because you want to be able to inspect the traffic flowing over it. You’ll also need to tie into the university’s identity management platform to make sure that only authorized users have access to the server. Whatever you decide to to, at least deliver a copy of your documentation, because once you’re out of the picture, it’s going to be up to campus IT to maintain it.
bergetfew@sopuli.xyz 1 day ago
Honestly, after considering the security implications of enabling access to the university’s network, I think I would first warn the team about this before setting up anything and let them decide how to proceed afterwards. I’ll also inform them to ask the IT department for the in-house VPN solution and identity management.
I don’t believe there would be need for the team to access anything in the network apart from the computer itself. Is it possible to arrange a solution that disables connections to intranet devices through the server by default just to be safe?
1995ToyotaCorolla@lemmy.world 1 day ago
Sounds good! It’s always a good idea to make sure everyone is on the same page about the risks involved in a project. I must also stress that you reach out to IT personally and make sure they know what’s going on. We’ve definitely had faculty go behind our back before, I’m sure that happens at other schools too, lol. I do have some final thoughts based on your bullet points to consider:
1) Server computer is a Mac Mini (latest model I think?). I’ve been told they would replace macOS with Linux, still I believe I should ready if they don’t (I don’t have experience with macOS at all)
I would personally avoid this, just due to the fact that the hardware might be in an insecure area and easily forgotten. Once the team is done with it, they might just leave it in place to idle forever. Or, someone might find it, not know what it is, and remove it. A VM running in the campus datacenter is a lot safer than a computer under a lab counter. This also avoids future hiccups with an exotic OS/hardware combination that you might not be thinking about right now.
*2) Server will be situated in university and provided a static IP address *
You’re going to need IT’s involvement on this, full stop. Just because an address isn’t in use right now on the campus network, doesn’t mean that it’s free for you to use. As far as public facing IPs go, those are totally managed by campus IT. You will need their permission to host services on them.
3) Team needs remote access to the server, presumably comfortable with using CLI
See number 2. You need IT’s permission to host services on the network.
4) I am unlikely to be permitted access to server myself after setup, so it should be ready to be managed by the team
You need to document everything you set up ready to hand off to whomever will be managing this server. This is unlikely to be someone on the research team, as if they can’t set it up themselves, I doubt they’ll be able to maintain it.
5) Extra hardware and/or paid software could be arranged but to a limited extent and within reason
There’s generally going to be a budget and/or grants available depending on the scope of the work the research team is doing. Going through the proper channels (IT Dept and Grant Officer) will give you access to these resources. As an example, a center involved with our school was doing watershed research and we were able to secure them a grant for tablets they could use for fieldwork.
One final, important thing to consider is what data this research team is collecting, what they’re using it for, and what’s going to happen to it once they’re done with it. If there is any PII (Personally Identifiable Information) in this dataset, there might be laws (e.g. GDPR) that you might need to comply with.
I hope that you don’t think that I’m harping on you too bad, it’s just that there’s lots to consider outside of the raw technical side of things that many homelabbers don’t really have to think about.
golden_zealot@lemmy.ml 1 day ago
Perhaps consider a SOCKS5 reverse proxy. If done over SSH, the client systems networking would act as though they are on the server itself, traffic would be secure, and it would walk around most firewall rules that probably exist.
Specifically, read up on “bastion hosts”.