perfSONAR User Q&A and Other Discussion

[Mark Foster <>]

Based upon what Brian told me, we were one of the (very few) that said we 
were actually using it. And our use was more out of (trivial) convenience 
than need.  While I appreciate the efforts to secure it, and to provide 
option 1, I'd suggest option 2.

-- Mark 
NASA Ames Research Center

On 7/9/2014 11:09 AM, Jason Zurawski wrote:
> All;
> 
> Jumping into the wayback machine for this one - earlier this year we did an 
> informal poll about who is using cacti, and who would be terribly bothered 
> about it disappearing.  At the time there was some support for it 
> remaining, and some that felt it didn't provide a whole lot of value.  
> 
> Given the recent exploits of this product causing increased levels of 
> heartburn for those in the user community, we wanted to raise the issue 
> again and this time offer some possible suggestions on ways forward:
> 
> Option 1: Remain the same as we operate now.  Cacti is installed, it 
> receives regular patches for when exploits occur, and it is 'locked down' 
> to only allow administrative users on the toolkit access (e.g. the public 
> viewable feature was removed a month ago after the last security 
> vulnerability)  
> 
> Option 2: Remove cacti from the default install (not with the next release, 
> but something in the near future), and provide a package (via yum) and 
> instructions that would restore it for sites that want to use the tool.  
> 
> Your feedback is valuable as we try to balance the needs of security and 
> functionality.  
> 
> Thanks;
> 
> -jason
> 
> On 13 February 2014 05:00, Brian Tierney 
> <>
>  wrote:
> 
>> Hi All:
>>
>> We'd like to know if anyone is currently actually using Cacti, which is 
>> bundled on the perfSONAR toolkit, for collection of SNMP data.
>>
>> We are considering removing this in future releases, and wonder if anyone 
>> will notice.
>>
>>
>> -- 
>> Brian Tierney, http://www.es.net/tierney
>>
>> Energy Sciences Network (ESnet)
>>
>> Berkeley National Lab