• Arbitrations
• a20120528.1

• Case Number: a20120528.1
• Status: closed
• Claimants: Bas D., Stefan Kooman
• Respondents: CAcert

• Initital Case Manager: MarcusMaengel in the role of SE

• Case Manager: SebastianKueppers

• Arbitrator: UlrichSchroeter

• Date of arbitration start: 2012-05-28
• Date of ruling: 2012-05-31
• Case closed: 2012-05-31
• Complaint: Emergency Dispute: Access to server due to signer problem
• Relief: TBD

Before: Arbitrator UlrichSchroeter (A), Respondent: CAcert (R), Claimant: Bas D (C) Stefan Kooman (C2), Case: a20120528.1

History Log

• 2012-05-28 (issue.c.o) case s20120528.120

• 2012-05-28 (iCM): added to wiki, request for CM / A

• 2012-05-28 (A): I'll take care about this case as (A) and appoint SebastianKueppers as (CM)

• 2012-05-28 (A): intermediate ruling #1 dictated via mobile to MarcusMaengel, sent to (C), (AcccessEngineers), (Critical team), (CM), (A)

• 2012-05-28 (Mendel): proposed Emergency Visit BIT -> 22:00

• 2012-05-28 (Wytze): 2012-05-28 Emergency Visit BIT report "investigate and fix broken signer service"

• 2012-05-29 (A): sending confirmation request regarding the Emergency visit report to Stefan and Mendel
• 2012-05-31 (A): reminder for confirmation request to Stefan and Mendel
• 2012-05-31 (Mendel): report confirmed
• 2012-05-31 (Stefan): report confirmed

Original Dispute, Discovery (Private Part)

• -----Oorspronkelijk bericht-----
  Van: Stefan Kooman [mailto:stefan@cacert.org] 
  Verzonden: maandag 28 mei 2012 12:54
  Aan: Mendel Mobach; support@cacert.org
  CC: Mendel Mobach; Wytze van der Raay; team-nl@oophaga.org;
  jandd; Stefan Kooman; stefan@cacert.org
  Onderwerp: Emergency Visit BIT - Signer server not responding
  
  Dear Support,
  
  Mendel Mobach (critical sys admin) discovered that the signer server it
  not responding any longer. Problem arised at Sun 27 May 2012 04:00 CEST
  
  Mendel Mobach and Wytze van der Raay will be visiting the Hosting
  Facility @BIT, Ede this evening, Monday 28 May 2012. There is no
  confirmed starting time just yet, but the expected time frame is between
  
  20:00 and 24:00 h.
  
  Stefan Kooman, Oophaga Access Engineer, will be there to provide them
  physical access.
  
  Please authorize this emergency visit.
  
  Thanks,
  Stefan Kooman

• Link to Arbitration case a20120528.1 (Private Part)

EOT Private Part

Discovery

• Within the last days, some reports received by (Support) and public mailing list eg cacert-support: 2012-05-27 Cert issuing delay, that signer was slow, later not responding

Intermediate ruling #1

I order that one access engineer and one critical adminstrator are allowed to access the BIT facilities to fix the actual signer problem.

Ruling given by telephone by Arbitrator UlrichSchroeter, forwarded via email by Marcus Maengel as ICM 2012-05-28

Berlin, 2012-05-28

Discovery II

• 2012-05-28 Emergency Visit BIT report by (Critical team t/l)

  • 2012-05-28 Emergency Visit BIT report "investigate and fix broken signer service"

  • Persons:
    • Stefan Kooman (Oophaga) (Access Engineer)
    • Mendel Mobach (CAcert) (Critical Admin)
    • Wytze van der Raay (CAcert) (Critical Admin)

Ruling

I will follow the the questions to answer from arbitration case a20090810.4

1. Was emergency access justified?

There have been several reports of a malfunction of the signer already, when the request for emergency access to the system was filed as a dispute.

Reestablishing one of CAcert's core services clearly justifies access to the system according to Security Policy 2.3.4. Emergency Access

2. What was the cause of Outage / didn't any changes have been cause of the outages?

Wytze have published an analysis what have led to the outages here: 2012-05-28 Emergency Visit BIT report "investigate and fix broken signer service"

There is no doubt what caused the dysfunction of signing service.

3. Have updates correctly been processed dual control etc etc.?

Dual control of the actions performed has been performed by Wytze as critical systems engineer, Mendel as second critical systems engineer and Stefan as access engineer. Wytze have published all his actions here:

• https://lists.cacert.org/wws/arc/cacert-systemlog/2012-05/msg00003.html

and Mendel and Stefan confirmed them to the Arbitrator by request.

According to the Security Manual 2.3.2 updates to the signer may require the presence of two critical system administrators. All actions applied to the signer where rather simple administrative tasks (reboot the server, fix harddisk error, time setting) and only touched temporary data for a failed request which will be resubmitted by the web server to the signer. Therefore dual control beeing established by an access engineer and two critical system engineer was sufficient.

All changes made to the WebDB server have been in compliance with the Security Manual.

4. Where all procedures followed correct?

All actions that have been performed on 2012-05-28 by Stefan, Wytze and Mendel have been in full compliance with the CAcert procedures.

5. Intermediate Ruling

The intermediate ruling #1 dated 2012-05-28 that I gave via mobile, written into an email and to the arbitration file by Support-Engineer Marcus Maengel on behalf of me (as I had no internet access) I hereby confirm as the intermediate ruling that I gave.

Frankfurt/Main, 2012-05-31

Execution

• 2012-05-31 (A): ruling sent to (C), Stefan, Mendel, Wytze, Marcus, (Board), team-nl@oophaga, (CM). Case is now closed.

Similiar Cases

• CategoryArbitration

• CategoryArbCaseSystemTasks