<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi All,<div class=""><br class=""></div><div class="">We have a similar setup, but with a different set of data tunnels, so to say. User owned external drives are outright banned from being connected to any system in the facility.</div><div class=""><br class=""></div><div class="">Our lab runs on an internal network that only allow communication within that network, and no access to the internet as a whole. The exceptions being dedicated IPSEC tunnels that connect to servers for tool access control, security cameras, and, among those, data storage.</div><div class=""><br class=""></div><div class="">Via these tunnels, every tool has access to two network share drives, and each drive maintains separate directories for every user registered to our facility. One drive allows a limited quota of disk space where files may be stored long-term, and the other drive allows unlimited storage but files older than 2 weeks are automatically purged. When a user enables a tool via out extremely customized implementation of CORAL, scripts automatically make the correct directory for that user available to the drive mounts on the systems in question. Users may then store anything they generate to these drives. Upon disable, the directories are made inaccessible to protect that user’s data.</div><div class=""><br class=""></div><div class="">Users may then retrieve their files via a webpage on our custom CORAL frontend, or while anywhere on campus they may mount their directories as a drive share on their personal systems. So similar to other implementations, we have a server-in-the-middle approach that allows us to isolate the lab from outside threats while still allowing our users store their data in a protected but accessible space, but everything is internal rather than using external services.</div><div class=""><br class=""></div><div class="">We’ve implemented storage to these drives in other creative ways for systems that are less capable or intentionally brain-damaged in some way, including having our old Alphastep 100 be able to store traces as an image to these drives when it would normally only be able to print to a physical, attached printer. All of this is thanks to a very talented and patient lead developer we are very thankful to have. So I realize this very custom approach may not be doable by everyone, but it certainly has worked well for us.</div><div class=""><br class=""></div><div class=""><div class="">
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">N. Shane Patrick<br class="">Electron Beam Lithography<br class="">Research Engineer, Washington Nanofabrication Facility (WNF) <br class="">National Nanotechnology Coordinated Infrastructure (NNCI)<br class="">University of Washington<br class="">Fluke Hall 129, Box 352143<br class="">(206) 221-1045<br class=""><a href="mailto:patricns@uw.edu" class="">patricns@uw.edu</a><br class=""><a href="http://www.wnf.washington.edu/" class="">http://www.wnf.washington.edu/</a></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On Sep 10, 2018, at 7:13 AM, Nathan Nelson - Fitzpatrick <<a href="mailto:nnelsonfitzpatrick@uwaterloo.ca" class="">nnelsonfitzpatrick@uwaterloo.ca</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class="">
<div class="">Hi Kevin,</div>
<div class=""><br class="">
</div>
<div class="">This is a very good question and I’m looking forward to reading all the responses that will come in.</div>
<div class=""><br class="">
</div>
<div class="">We have a similar suite of tools running older Windows versions in our lab. Our IT people have set up a Virtual LAN to let us network all of our tool PCs (including Windows XP and 7). The Virtual LAN is barred from sending or receiving traffic outside
of campus so we have greatly reduced worries about someone attacking vulnerable and un-patchable computer hardware. </div>
<div class=""><br class="">
</div>
<div class="">To transfer into and out of the cleanroom VLAN we have a locally hosted instance of OwnCloud (<a href="https://owncloud.org/" class="">https://owncloud.org</a> ). This sits on a server with one network card facing into the cleanroom network, and one network card
facing out to the general campus network. </div>
<div class=""><br class="">
</div>
<div class="">On all of the cleanroom computers we have installed a browser with the OwnCloud URL bookmarked, so a user will just login to their account through the Owncloud web interface and then uploading files is just a matter of “drag and drop”. The files can be
retrieved and downloaded on the user’s desktop computer using the same method (though the URL is different from the “in-cleanroom” URL).</div>
<div class=""><br class="">
</div>
<div class="">I would be happy to answer any questions you have about our solution.</div>
<div class=""><br class="">
</div>
<div class="">Best regards,</div>
<div class=""> -Nathan</div>
<div class="">
<div class=""><font face="Verdana" size="2" class="">-- </font></div>
<div class=""><font face="Verdana" size="2" class="">Nathan Nelson-Fitzpatrick PhD</font></div>
<div class=""><font face="Verdana" size="2" class="">Nanofabrication Process & Characterization Engineering Manager</font></div>
<div class=""><font face="Verdana" size="2" class="">Quantum-Nano Fabrication and Characterization Facility (QNFCF)</font></div>
<div class=""><font face="Verdana" size="2" class="">Office of Research</font></div>
<div class=""><font face="Verdana" size="2" class="">University of Waterloo</font></div>
<div class=""><font face="Verdana" size="2" class="">200 University Avenue West, Waterloo, ON N2L 3G1</font></div>
<div class=""><font face="Verdana" size="2" class="">P: 519-888-4567 ext. 31796</font></div>
<div class=""><font face="Verdana" size="2" class="">C: 226-218-3206</font></div>
<div class=""><a href="https://fab.qnc.uwaterloo.ca/" class=""><font face="Verdana" size="2" class="">https://fab.qnc.uwaterloo.ca</font></a></div>
<div class=""><span id="cid:CE86CB28-6FCA-4AE1-950B-126CD4A742E2"><university-of-waterloo-logo-esig[2].png></span></div>
<div class=""><span class="Apple-style-span" style="border-collapse: collapse; color: rgb(80, 0, 80);"><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt;" class=""><br class="">
</div>
<span class="Apple-style-span" style="font-size: 15px;"><br class="">
</span><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt;" class=""><br class="">
</div>
</span></div>
</div>
</div>
<div class=""><br class="">
</div>
<span id="OLK_SRC_BODY_SECTION" class="">
<div style="font-family: Calibri; font-size: 11pt; text-align: left; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);" class="">
<span style="font-weight:bold" class="">From: </span><<a href="mailto:labnetwork-bounces@mtl.mit.edu" class="">labnetwork-bounces@mtl.mit.edu</a>> on behalf of Kevin McPeak <<a href="mailto:kmcpeak@lsu.edu" class="">kmcpeak@lsu.edu</a>><br class="">
<span style="font-weight:bold" class="">Date: </span>Sunday, September 9, 2018 at 7:54 PM<br class="">
<span style="font-weight:bold" class="">To: </span>"<a href="mailto:labnetwork@mtl.mit.edu" class="">labnetwork@mtl.mit.edu</a>" <<a href="mailto:labnetwork@mtl.mit.edu" class="">labnetwork@mtl.mit.edu</a>><br class="">
<span style="font-weight:bold" class="">Subject: </span>[labnetwork] Getting files off older computers<br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">
<div dir="auto" class="">Dear Colleagues,<br class="">
<br class="">
Here at the LSU cleanroom, we have several older computers (e.g Win XP and Win 7) which are not allowed on the network. These computers are connected to instruments <span style="font-family:sans-serif" class="">(e.g. SEM and AFM)</span> that we often need to get files
from. Unfortunately, the instruments do not run on Win 10 (our network administrator won't allow Win 7 on the network as well).
<div dir="auto" class=""><br class="">
</div>
<div dir="auto" class="">The current protocol to get images etc. off these older computers is to use a cleanroom owned USB stick to move the file to one computer in the cleanroom which is on the network.
<div dir="auto" class=""><br class="">
</div>
<div dir="auto" class="">I do not like this protocol. It is very difficult to stop users from using their own USB stick, which could be infected. Also USB sticks grow legs.</div>
<div dir="auto" class=""><br class="">
</div>
<div dir="auto" class="">I suspect other facilities on the list have faced these same challenges. I am curious how you have resolved them. Thank you in advance for your input!</div>
<div dir="auto" class=""><br class="">
</div>
<div dir="auto" class="">Regards,</div>
<div dir="auto" class="">Kevin<br class="">
<br class="">
-- <br class="">
Kevin M. McPeak<br class="">
Assistant Professor<br class="">
Louisiana State University<br class="">
Dept. of Chemical Engineering<br class="">
3307 Patrick Taylor Hall<br class="">
Baton Rouge, LA 70803<br class="">
email: <a href="mailto:kmcpeak@lsu.edu" target="_blank" rel="noreferrer" class="">kmcpeak@lsu.edu</a><br class="">
phone: 225-578-0058<br class="">
</div>
</div>
</div>
</div>
</div>
</span>
</div>
_______________________________________________<br class="">labnetwork mailing list<br class=""><a href="mailto:labnetwork@mtl.mit.edu" class="">labnetwork@mtl.mit.edu</a><br class="">https://mtl.mit.edu/mailman/listinfo.cgi/labnetwork<br class=""></div></blockquote></div><br class=""></div></body></html>