- Case Number: a20120528.1
- Status: closed
- Claimants: Bas D., Stefan Kooman
- Respondents: CAcert
Initital Case Manager: MarcusMaengel in the role of SE
Case Manager: SebastianKueppers
- Date of arbitration start: 2012-05-28
- Date of ruling: 2012-05-31
- Case closed: 2012-05-31
- Complaint: Emergency Dispute: Access to server due to signer problem
- Relief: TBD
Before: Arbitrator UlrichSchroeter (A), Respondent: CAcert (R), Claimant: Bas D (C) Stefan Kooman (C2), Case: a20120528.1
2012-05-28 (issue.c.o) case s20120528.120
- 2012-05-28 (iCM): added to wiki, request for CM / A
2012-05-28 (A): I'll take care about this case as (A) and appoint SebastianKueppers as (CM)
2012-05-28 (Mendel): proposed Emergency Visit BIT -> 22:00
- 2012-05-29 (A): sending confirmation request regarding the Emergency visit report to Stefan and Mendel
- 2012-05-31 (A): reminder for confirmation request to Stefan and Mendel
- 2012-05-31 (Mendel): report confirmed
- 2012-05-31 (Stefan): report confirmed
Original Dispute, Discovery (Private Part)
-----Oorspronkelijk bericht----- Van: Stefan Kooman [mailto:email@example.com] Verzonden: maandag 28 mei 2012 12:54 Aan: Mendel Mobach; firstname.lastname@example.org CC: Mendel Mobach; Wytze van der Raay; email@example.com; jandd; Stefan Kooman; firstname.lastname@example.org Onderwerp: Emergency Visit BIT - Signer server not responding Dear Support, Mendel Mobach (critical sys admin) discovered that the signer server it not responding any longer. Problem arised at Sun 27 May 2012 04:00 CEST Mendel Mobach and Wytze van der Raay will be visiting the Hosting Facility @BIT, Ede this evening, Monday 28 May 2012. There is no confirmed starting time just yet, but the expected time frame is between 20:00 and 24:00 h. Stefan Kooman, Oophaga Access Engineer, will be there to provide them physical access. Please authorize this emergency visit. Thanks, Stefan Kooman
Link to Arbitration case a20120528.1 (Private Part)
EOT Private Part
Within the last days, some reports received by (Support) and public mailing list eg cacert-support: 2012-05-27 Cert issuing delay, that signer was slow, later not responding
Intermediate ruling #1
I order that one access engineer and one critical adminstrator are allowed to access the BIT facilities to fix the actual signer problem.
Ruling given by telephone by Arbitrator UlrichSchroeter, forwarded via email by Marcus Maengel as ICM 2012-05-28
- 2012-05-28 Emergency Visit BIT report by (Critical team t/l)
- Stefan Kooman (Oophaga) (Access Engineer)
- Mendel Mobach (CAcert) (Critical Admin)
- Wytze van der Raay (CAcert) (Critical Admin)
I will follow the the questions to answer from arbitration case a20090810.4
1. Was emergency access justified?
There have been several reports of a malfunction of the signer already, when the request for emergency access to the system was filed as a dispute.
Reestablishing one of CAcert's core services clearly justifies access to the system according to Security Policy 2.3.4. Emergency Access
2. What was the cause of Outage / didn't any changes have been cause of the outages?
Wytze have published an analysis what have led to the outages here: 2012-05-28 Emergency Visit BIT report "investigate and fix broken signer service"
There is no doubt what caused the dysfunction of signing service.
3. Have updates correctly been processed dual control etc etc.?
Dual control of the actions performed has been performed by Wytze as critical systems engineer, Mendel as second critical systems engineer and Stefan as access engineer. Wytze have published all his actions here:
and Mendel and Stefan confirmed them to the Arbitrator by request.
According to the Security Manual 2.3.2 updates to the signer may require the presence of two critical system administrators. All actions applied to the signer where rather simple administrative tasks (reboot the server, fix harddisk error, time setting) and only touched temporary data for a failed request which will be resubmitted by the web server to the signer. Therefore dual control beeing established by an access engineer and two critical system engineer was sufficient.
All changes made to the WebDB server have been in compliance with the Security Manual.
4. Where all procedures followed correct?
All actions that have been performed on 2012-05-28 by Stefan, Wytze and Mendel have been in full compliance with the CAcert procedures.
5. Intermediate Ruling
The intermediate ruling #1 dated 2012-05-28 that I gave via mobile, written into an email and to the arbitration file by Support-Engineer Marcus Maengel on behalf of me (as I had no internet access) I hereby confirm as the intermediate ruling that I gave.
- 2012-05-31 (A): ruling sent to (C), Stefan, Mendel, Wytze, Marcus, (Board), team-nl@oophaga, (CM). Case is now closed.