Do you need to change your coxeter (and hence mail) password?

Due to the recent Heartbleed bug <http://main.its.utoronto.ca/news/heartbleed-notice/> we recommend that you change your coxeter password.  Simply type passwd on coxeter and follow the instructions.

If you are completely certain that you have never typed your coxeter password into a website (that includes departmental websites such as mail, since it is possible that website protections were compromised) and if you never typed your password into pine then as long as you do not use your coxeter password on any other sites/machines then you would not need to change your password.

New certificates have been installed on our two main servers www and mail.  These are the main servers where people might type in passwords; the other math.toronto.edu servers that use certificates will be updated on Monday.

The escalator.utoronto.ca sites are waiting for new certificates from the University.

It seems that only the web servers and mail in our department were affected by the Heartbleed bug.  We patched all of them immediately (which necessitated the coxeter reboot on Wednesday) and now are waiting to install updated certificates for our various servers.  Until the updated certificates are installed changing passwords and using them on our web or mail servers is not protected.  We hope to have the new certificates ready on Monday and at that point we will have more information about password resets.

The official UofT link for information about the Heartbleed bug is:

http://main.its.utoronto.ca/news/heartbleed-notice/

Earlier today there were some networking issues in the department due to failing ports on our main switch which caused various connectivity problems to various people (some people had trouble connecting to coxeter, others to the mail server and others to the printers).  Everything seems to be back to normal now.

We have recently been told that the installation of complete wireless coverage for the Earth Sciences Centre has now been scheduled and that it should be completed by the end of May.  New high-performance 802.11ac access points will be used.  This will be welcome news for our departmental members in ESC who have had to contend with very spotty wireless coverage in there for quite some time.

Microsoft says that they will no longer support Windows XP starting on April 8, 2014.  See:

http://www.microsoft.com/en-us/windows/enterprise/endofsupport.aspx

for more information.  Some IT Security people expect that there are malicious people waiting for that date to take advantage of Windows XP computers.  Windows XP should not be used on networks after the support ends.

University owned computers can be upgraded with software available at:

https://microsoft.utoronto.ca/

For additional information about the new certificate for the UofT wireless system please see:

http://help.ic.utoronto.ca/solution_id_1942.html

Because the server certificate for the UofT and eduroam wireless networks here at the University are being renewed you will be asked to accept/verify this new certificate the first time you connect after it is installed (on March 10, 2014).  This should only happen once per wireless device.

Here is the message about this that was posted by the  Academic and Collaborative Technologies Support Manager on Blackboard:

On Monday, March 10th, the security certificate for the University’s wireless authentication server will be renewed.

When attempting to connect to the UofT or eduroam networks after this update, you will be prompted to accept or verify the new certificate. Once you accept the new certificate, your wireless device will save the setting and connect automatically thereafter.

For campus wireless access information, please visit the Information Common website at http://help.ic.utoronto.ca/content/20/704/en/wireless-access.html

It is University policy that any personal and other confidential information that is outside our secure server environment with restricted user rights must be protected with properly implemented encryption.  This means that any personal desktops, laptops, tablets, smartphones, USB keys, etc. must not have personal or other confidential information unless they are securely encrypted.  This can help prevent any data breaches caused by lost/stolen hardware, although any system with personal and other confidential information must also be kept secure with restricted access, up-to-date software (including the OS), etc.

There are resources describing encryption and what types of information must be protected at: http://encrypt.utoronto.ca

If you have any questions please send email to requests@math.toronto.edu

Complimentary MATLAB seminars for educators, academic researchers and students at University of Toronto have been scheduled:

View complete session descriptions and register at www.mathworks.com/seminars/UTOR2014.