<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<div id="divtagdefaultwrapper" dir="ltr" style="">
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt; margin-top: 0px; margin-bottom: 0px;">
All,</p>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt; margin-top: 0px; margin-bottom: 0px;">
<br>
</p>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt; margin-top: 0px; margin-bottom: 0px;">
We've got to start applying the changes required to put in engineered controls over remote write-access. Recall the 4 areas we have to address are:</p>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt; margin-top: 0px; margin-bottom: 0px;">
</p>
<ul style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt; margin-bottom: 0px; margin-top: 0px;">
<li><span style="font-size: 12pt;">PLC logic</span><br>
</li><li>FPGA firmware<br>
</li><li>IOC/application code<br>
</li><li>Channel Access<br>
</li></ul>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt;">
</p>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt; margin-top: 0px; margin-bottom: 0px;">
</p>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt; margin-top: 0px; margin-bottom: 0px;">
</p>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt; margin-top: 0px; margin-bottom: 0px;">
</p>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt; margin-top: 0px; margin-bottom: 0px;">
<br>
</p>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt; margin-top: 0px; margin-bottom: 0px;">
Changes planned for Monday:</p>
<p style="margin-top: 0px; margin-bottom: 0px;"></p>
<ul style="margin-bottom: 0px; margin-top: 0px;">
<li style="">Option to use PLC mode switch to restrict remote editing (switch settings: run/rem/prog).
<ul>
<li style="">(CAROLINA) I'd like to have a PV readback for this tag as soon as possible. </li></ul>
</li><li style="">Restrict filesystem write-access to lclsapp1 and lclsapp2 only. This may require reboots on VDI hosts and control room to ensure read-only NFS.</li><li style="">Access to lclsapp1/2 will start be granted by request.
<ul>
<li style="">To handle this, we have to move/remove the ssh keys for softegr and laci.</li><li style="">After being granted access, you will be able to ssh to lclsapp1/2 and sudo into softegr or laci account.</li><li style="">I expect this to be fairly flexible for the time-being, but that will change.</li></ul>
</li></ul>
<span style="font-size: 12pt;">
<div id="divtagdefaultwrapper" dir="ltr" style=""><span style="font-size: 12pt;"><br>
</span></div>
For channel access, we are in the process of building the access control file (acf) that will need to be loaded by all IOCs. The acf and caputlog config will need to be installed in the near future. The EPICS_CA_ADDR_LIST will have to be updated to include
a jlab ca_gateway. I'm sorting out the correct hostname for that.</span><br>
<br>
<p></p>
</div>
<div id="divtagdefaultwrapper" dir="ltr" style="">As things firm up and I have better dates and description of the full implementation. I will post to this mailing-list. Please bear with us while we work through this. We are trying to make it as streamline
as possible and keep the environment impact to an absolute minimum. </div>
<div id="divtagdefaultwrapper" dir="ltr" style=""><br>
</div>
<div id="divtagdefaultwrapper" dir="ltr" style="">Wesley</div>
</div>
</body>
</html>