Since the security incident last week, we have been working with UCT CSIRT to investigate the extent of the compromised systems and to understand if a data breach has occurred. Similar incidents have impacted several other HPC and Cloud sites. The investigation is still ongoing, and unfortunately we cannot resume operations until it is complete.
We believe that the attack vector was compromised SSH keys. SSH access to ilifu has been restricted since Thursday, 28 May. We have removed all existing SSH keys from ilifu user accounts. We will send out information about account access and adding new keys when we are ready to resume operations on ilifu. In parallel to the investigation, we are working on implementing further enhanced security measures.
We strongly recommend that all users cycle their SSH keys at other remote sites as soon as possible.
