We're pleased to announce the release of a new feature: single sign-on for D-PHYS services. It will allow you to reuse an existing login session from one website to authenticate additional services. It will also give you the option to use passkeys to further simplify your login experience. In order to improve account security, password logins will require an MFA step (the same TOTP mechanism ETH ID uses).

Here's the timeline:

• the Authentik auth provider website is available immediately.
• in order to give you ample time to prepare your TOTP and passkeys and familiarize yourself with the auth flow, there's a 3 week grace period in which only two minor services (the LTS dashboard and [later this week] the MAC registration) use the new auth method. This way, you won't be surprised by essential services suddenly requiring MFA while still giving you two websites to play with.
• after September 21, we will start moving services from the current LDAP login to Authentik auth via OIDC. Since this migration can be quite complicated and requires thorough testing, we will perform it one service at a time, starting with Backupbox, the D-PHYS events and the mailing list interface. Afterwards, we'll migrate Roundcube webmail.
• if we encounter issues with any service, we can immediately revert to LDAP login.

So please head over to Authentik and set up your MFA token. Authentik will guide you through the process during your first login. Just use the same authenticator app you already have in place for your ETH account. If you'd like to give passkeys a go, our service documentation has all the details.

Scheduled maintenance will be taking place on our group-data.phys.ethz.ch server on Monday, July 27, starting at 16:30. The service will be down for approximately 5 hours. We will be replacing some hardware and upgrade the base system.

All group shares will be affected except IPA and IGP.

For emergency cases, you'll have read-only access to the backups as described here.

It is my pleasure to welcome Ludwig Bellstedt into our group. He joins us to complete the Linux team.

Welcome Ludwig!

This post is meant to give you a short overview of what has been accomplished in D-PHYS IT by ISG this year. We’ve been hard at work to further improve and extend our services for you, our customers.

Some highlights of 2025:

• Lab networks: in order to assist the research groups with their increasingly complex networking requirements, we introduced a new isolated networking scheme.
• Managed workstations: the migrations to Windows 11 and Debian Bookworm have been completed.
• Storage and backup: we modernized the backup infrastructure and implemented significant behind-the-scenes improvements. The disk space occupied by data and backup grew only slightly from 5.3 PiB to 5.4 PiB.
• Infrastructure work: our Debian and Ubuntu mirror has been migrated to new hardware.
• Windows software deployment: we're currently beta-testing the Baramundi service to replace our long-established Windows software deployment.
• Security (Linux): we had to develop tooling to detect and protect from DDOS/AI scraping. Our firewall now limits connections from 90+ cloud hosting providers on servers and is more restricted on workstations.
• Matrix/Element: usage almost doubled to 1461 active users.
• Knowledge management: together with 3 research groups we're currently evaluating an AI system to interactively explore the knowledge hidden in lab journals and publications.
• Outages: apart from some short-term network interruptions, our systems were very stable in 2025.
• Apprentice: our apprentice Vanessa successfully completed her training in August. Her successor Alessio will start in February.

I would like to take this opportunity to thank my whole team for their hard and dedicated work all year long.

Happy Holidays and see you in 2026!

This post is meant to give you a short overview of what has been accomplished in D-PHYS IT by ISG this year. We’ve been hard at work to further improve and extend our services for you, our customers.

Some highlights of 2024:

• Infrastructure work: the Vaultwarden password manager was introduced as a new service.
• Email: As part of our continous email server improvements, we updated the Mailman mailing list software to a new major release and drastically increased IMAP search performance.
• Linux workstations: we overhauled the managed Linux workstations setup and migrated almost all Ubuntu workstations to Debian Bookworm.
• Storage: we streamlined the storage infrastructure and implemented significant behind-the-scenes improvements. The disk space occupied by data and backup grew from 5.1 PiB to 5.3 PiB.
• ISG lecture series: we teamed up with our SIS colleagues and managed to increase attendance of the Basics of Computing Environments for Scientists lecture series.
• Matrix/Element: We started collaborating with EPFL who joined the federation. We also received the first spam and implemented countermeasures and additional logging. This year we counted 819 active users on 2978 devices (1014 Windows, 472 Mac, 370 Linux, 534 Android, 276 iPhone, 105 iPad), who sent 1'158'897 messages in 6'740 rooms created on our server. Our users also participated in 1'746 other (and 1'563 spam) rooms with 1'790'894 messages.
• Outages: apart from some short-term network interruptions, our systems were very stable in 2024.
• OS upgrades: almost all managed Windows workstations have been upgraded to Windows 11 and the first Macs to Sequoia.
• Apprentice: we take part in the new Wayup apprenticeship pilot project and could welcome first Eric and now Vanessa into our team.

I would like to take this opportunity to thank my whole team for their hard and dedicated work all year long.

Happy Holidays and see you in 2025!

This announcement will probably not affect too many users, but it might have some impact and we can't narrow down the recipient space.

For some time now, our group shares on groupdata.phys.ethz.ch, when mounted via SMB, allowed so-called wide links - they point from one group share to a place outside of this share (usually to another share). For $complicated_reasons we have to disable those wide links. This will break redirection to the target share. We believe this is mainly a convenience issue, but we might not be aware of legitimate use cases. So if you find something broken after

Tuesday, October 8, 2024

please get in touch so that we can find a solution. Links within a particular share will still work, but link targets have to be relative (../../papers/thesis.tex) instead of absolute (/home/sharename/documents/papers/thesis.tex).

Thanks.

This one goes out to all HPT inhabitants. As you might have noticed, the HPT network infrastructure is currently being remodelled. In order to be able to take full advantage of the new uplink cables and access switches, ideally all grey patch cables (from the wall sockets to the devices) should be replaced as well (the blue ones are OK). We do realize that this is not realistic in many (lab) settings, but please swap them out for new cat6 cables whenever you can (they're available in the D-PHYS Shop). Don't hesitate to contact us if you have questions.

TL;DR: we now offer a password manager service that also allows sharing passwords within groups.

Full story:
For a long time, we've been trying to promote IT security in general and secure password handling in particular. In both our introductory course and our documentation we recommend using a password manager to securely handle the plethora of passwords that modern-day life usually entails (hopefully a different one for each service!). What we did not have however was an easy-to-use solution to sync your password vault across your different devices. Yes, there's KeePassXC that can work with Polybox to ensure coherent password databases on all devices, but that's not exactly straightforward to set up.
In order to make setting up and handling the password manager easier for you, we're now announcing a new service: an Open Source password vault hosted at ISG D-PHYS:
Vaultwarden is an alternative implementation of the the Bitwarden backend and we've been evaluating it for a while. It now seems ready for prime time so after testing within ISG, we're releasing it to the Department. Aside from easier daily usage, it offers another feature that many (research) groups might find interesting: passwords and confidential information in general can be shared with others, e.g. the group's credit card with all PhD students.
If you'd like to give it a try, please read our service description to get started.

This post is meant to give you a short overview of what has been accomplished in D-PHYS IT by ISG this year. We’ve been hard at work to further improve and extend our services for you, our customers. Unfortunately, two of our colleagues had to take extended sick leaves this year, so we didn't have as much capacity for innovation and had to focus on system maintenance.

Some highlights of 2023:

• Storage: in the first half of 2023, we performed a major overhaul on our storage and backup infrastructure in both hardware and software. The disk space occupied by data and backup grew from 4.8 PiB to 5.1 PiB.
• Infrastructure work: our Ansible deployment setup was further extended and refined. All Windows servers have been added as well as the macOS clients.
  All eGroupware users were migrated to the new SOGo calendar. We also enabled DKIM signing on our D-PHYS mailserver. The Windows HyperV cluster has been upgraded for better performance.
• Matrix/Element: We upgraded both the OS and the Matrix server software. This year we counted 748 active users on 2579 devices (1019 Windows, 517 Linux, 424 Mac, 619 Mobile), who sent 1'086'537 messages in 5'510 rooms created on our server. Our users also participated in 763 other rooms with 1'157'466 messages.
• ISG lecture series: our Basics of Computing Environments for Scientists lecture series was held twice in 2023 with shockingly low attendance.
• Outages: apart from some short-term network interruptions, our systems were pretty stable in 2023.
• OS upgrades: work is well underway to migrate the managed Linux workstations from Ubuntu to Debian and the majority of servers are now running Debian bookworm. The Windows team started the Windows 11 rollout. Most of the managed Macs were upgraded to macOS Ventura.
• Software upgrades: mostly incremental upgrades in our Windows and Linux software list this year.
• IT security: with the world being what it is, IT security plays an ever increasing role in our work and permeates all our plans and projects. We also take part in the current rewrite of ETH's IT security regulations. On the Windows virus scanner front, Sophos was EOL'd and replaced by Windows Defender.

I would like to take this opportunity to thank my whole team for their hard and dedicated work all year long.

Happy Holidays and see you in 2024!

Update 27.11.: We now have the migration dates and final printer list here

As you might have read elsewhere, ETH will consolidate its printer fleet for cost cutting reasons. Even though at D-PHYS we already have a very efficient printing landscape, ID will enforce a uniform 30% cut across the board. We have tried to limit the impact as much as possible and still ensure a fair and even printer distribution throughout D-PHYS, but the implications will be felt by everyone.

• 30% of all existing printers in D-PHYS will be dismantled.
• All remaining printers will be replaced with HP hardware.
• All those will get new generic queue names (like p-hil-hp002) that bear no indication as to the printer's location in the building.
• Everybody will have to reinstall all printers they'd like to use in the future.
  • on managed workstations we will prepare this as much as possible.
  • on self-managed machines you'll have to follow our instructions.
• This might be the perfect opportunity to switch over to the universal card-ethz queue that will let you forget about queue names (you can do that already now).
• We understand that for some of you this change will significantly affect your daily work. We urge you to PLEASE not try to solve the problem by buying your own printer. Instead, please get in touch with me (Christian Herzog) so that I can collect your complaints and forward them to the person responsible for this change.

The whole process is supposed to happen in December and will be rolled out building by building. We're posting this already now as individual printers in D-PHYS have already been replaced.

We will update this post with updates as they become available.