CyberRange

To limit access for a set of resources in UMIACS, we may protect the resources with a cyber range consisting of one or more internal networks.

This is achieved by using bridge hosts - host(s) for each cyber range that can be used to access the networks, and thus devices, within that cyber range. Devices within a given cyber range do not have direct network access to outside that cyber range. All data transfer for a given cyber range must be staged through the bridge host for that cyber range.

No computational intensive activities are to be executed on the bridge hosts. Processes will be killed as need be to maintain the availability and access of all cyber ranges.

There is no limit to the number of networks that can be associated with a given cyber range. One secondary network that many cyber ranges may have is one to access out-of-band management devices such as baseboard management controllers (BMCs) through IPMI for bare metal servers in the range.

Access

To access cyber range bridge hosts in UMIACS, you must be connected to either the UMIACS wired network or UMD's GlobalProtect VPN.

After connecting, you can SSH to the bridge host for a cyber range (eg. ssh username@bridge_host.umiacs.umd.edu) and provide your credentials and MFA to connect. Once you are connected, you can now jump to any internal host in that cyber range over SSH. If you need to access a graphical interface, see the Remote Desktop Access section below.

If you need to stage data onto a device within a cyber range, you can use the bridge host for that cyber range as a SSH jump host. Here are some examples using scp or rsync.

• scp -J user@bridge_host /path/to/local/file user@target_server:/path/to/destination/
• rsync -avz -e "ssh -J user@bridge_host" /path/to/local/folder/ user@target_server:/path/to/destination/

Temporary Storage

If data needs to be temporarily stored on the bridge host for a cyber range, it can be stored in /scratch0. This directory is not backed up and should not be used to hold primary copies of any data that is critical. If the scratch space on a bridge host becomes full, the Technical Staff reserve the right to clear out the space as necessary to support the activities of the cyber range.

Network Services

Network services like DNS and DHCP are provided by each cyber range's bridge host to that internal cyber range's networks.

Remote Desktop Access

Bridge hosts provide Remote Desktop access locally that can be used with a simple SSH port forwarding tunnel. In a local terminal window, you can run the following command to start this tunnel, providing your credentials and MFA.

ssh -L 33389:localhost:3389 username@bridge_host.umiacs.umd.edu

You can then use your local RDP client to connect to bridge_host.umiacs.umd.edu:33389 and you will be logged into a console session on the bridge host. You can disconnect and re-connect to the console.