EGI CSIRT:Advisory/EGI-ADV-20120801/

** WHITE information - unlimited distribution allowed                       ** 

** see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions **

EGI CSIRT ADVISORY [EGI-ADV-20120801] 


Title:       EGI CSIRT ADVISORY [EGI-ADV-20120801] concerning gLite 3.2         
             middleware components no longer supported on 01 August 2012.

Date:        2012-08-01 send to sites
             2012-09-25 on public wiki 


Introduction
============

This advisory is being issued to remind sites which currently deploy gLite 3.2 software 
components which are no longer under security support to migrate to supported software. 

Various sites still deploy gLite 3.2 middleware components which on the 1st August 2012 are 
no longer under security support. 

The gLite 3.1 distribution is now retired. Sites still deploying gLite 3.1 software components 
have also been identified. This advisory includes a reminder of the decommissioning calendar applicable 
to gLite 3.1 software components and generally speaking to any software reliant on RHEL4 derivatives.

This advisory describes the detailed timelines for the retirement of unsupported software components 
as agreed between EGI CSIRT, the Operations Management Board, and the Security Co-ordination Group, 
which must be adhered to and describes the consequence of failing to do so.

It should be noted that regardless of these deadlines if a critical vulnerability affecting any software 
out of security support is published it may not be possible to produce an update and will be necessary 
to immediately stop the affected services and reinstall with currently supported software releases.  



Retirement calendar of gLite 3.2 components out of security support on 1st August 2012
=======================================================================================

The gLite 3.2 components currently out of security support are:

APEL
ARGUS
BDII
Cluster
CREAM
dCache
LB
LSF utils
MPI utils
SCAS
SGE utils
Torque client/server/utils
VOMS

See gLite 3.2 support calendar [R 1]. This advisory refers to these. 

All unsupported gLite 3.2 software components listed above and deployed in production are 
expected to migrate away as soon as possible and no later than 1st October 2012. 

Deployment of the unsupported gLite 3.2 components listed above will be monitored by EGI CSIRT. 
A report of any sites which are still deploying the unsupported gLite 3.2 components after 
01 October 2012, will be produced for EGI management. 


Suspension Policy
=================

From 1st November 2012 sites still deploying the unsupported gLite 3.2 software components 
mentioned above will be asked to  migrate to supported software immediately or to shutdown 
services.

Sites may face site suspension if failing to migrate their services. 
Exceptions may be made if the site is in communication with EGI CSIRT and upgrades are in progress. 
As it is acknowledged that some sites wish to migrate from gLite 3.2 to the UMD 2/EMI 2/RHEL6 based 
versions, exceptions may also be made if the site is planning to migrate  straight to EMI 2 based on 
RHEL6 but the appropriate software is not available in EGI UMD2 on 01 November 2012 or has been 
available for less than 1 month.


Reminder for gLite 3.1 and software reliant on RHEL4 derivatives.
=================================================================

Sites deploying gLite 3.1 software components and/or software reliant on RHEL4 (including SL4) must 
migrate away from these by 1st October 2012.
These sites have been individually contacted by CSIRT on 16th July 2012, therefore should 
be aware of this.

On 1st October 2012 such sites will be asked to migrate to supported software or shutdown 
services immediately. Failure to comply will result in site suspension. 
No exceptions or further extension of this deadline will be made.


Notes
=====

Please be aware that this notice only applies to software which is already out
of security support on 1st August 2012.  Retirement calendars for software 
which comes out of security support in the future will be made at a later date. 

This notice was sent to sites on 1st August 2012, and is now placed on the wiki


Other information
=================

In the coming months EGI will review its security policies in order to no longer 
allow the deployment in production of software which is out of security support.
See [R 2] and [R 3] for further information on supported middleware versions.


References 
==========

[R 1] gLite 3.2 support calendar http://glite.cern.ch/R3.2/
[R 2] EMI support calendar http://www.eu-emi.eu/releases#MajRel
[R 3] General support information from technology providers 
https://wiki.egi.eu/wiki/Middleware#Technology_Providers