Equipment Housing and Colocation – Terms and Conditions

Equipment Housing and Colocation – Terms and Conditions

The housing & colocation service is available at the shared DEEC/ISR/IT/INESCC Datacenter. This service consists of placing (colocation) a server or other IT equipment with network access in this facility.

As the server is supplied by the client, it will also be configured, administered, and maintained (hardware and software) by the client. In this way, the owner may install any software they wish and configure it in detail.

The space dedicated to this service has redundant connections to the network core and is connected to a UPS (limited to equipment without GPUs for computing purposes). It is physically secure; therefore, new requests are subject to availability verification.

Benefits and Features

Power – Access to UPS (limited to equipment without GPUs for computing purposes), ensuring greater electrical safety and equipment stability
Temperature Control – HVAC system (temperature and humidity control) providing continuous control of temperature and relative humidity
Connection to Network Core – Direct connection to the network core for greater stability, higher access speeds, and low latency between applications and users
Security – Restricted-access area providing increased equipment security

Owner Responsibilities

Installation (support may be requested)
Network configuration (support may be requested or required data provided)
Base system configuration, accounts/access, application layer, and services
Maintenance
Operation
Backups
Software updates
Troubleshooting
Licensing

Best Practices

Access Control

Use individual accounts; never shared accounts
Apply the principle of least privilege (access only to what is strictly necessary); keep administrative accounts separate from regular user accounts
Follow best practices for password usage
Use passphrase-based passwords – https://www.keepersecurity.com/features/passphrase-generator/
Do not include personal or institutional information
NEVER reuse passwords from other services
Enable two-factor authentication (2FA) whenever possible
Use a password manager to facilitate the above best practices – we recommend https://bitwarden.com/
Separate read, write, and administrative permissions, granting only what is strictly necessary
Review permissions regularly

Organisation and Structure

Use well-structured directories according to specific needs
Avoid storing personal data outside authorised locations
Review file system permissions regularly

Remote Access

Access to administrative interfaces only via the institutional VPN
Command-line access should be disabled whenever possible or allowed only via the institutional VPN when strictly necessary, and only using cryptographic keys
Avoid direct Internet access without a firewall for any service that is not strictly necessary
Disable unused services and ports

Updates and Maintenance

Keep the operating system up to date
Apply security updates as soon as they are available
Remove obsolete or unused services

Backups

Ensure automated backups are in place
Follow the 3-2-1 rule: 3 copies of data, on 2 different types of media, with 1 copy off the primary system
Periodically test backup restoration

Risks Associated with Improper Use of Systems

Loss of irreplaceable data
Breach of personal data
Compromise of credentials
Interruption of installed services
Unauthorised access to sensitive information

Anomalies and Issues

For security reasons, in the event of detected anomalies (viruses, malware, software malfunction, etc.), security breaches (compromised accounts, etc.), or any other issue that may potentially impact the remaining infrastructure, the equipment will be immediately disconnected from the network and/or power supply and returned to the owner for correction of the identified issues.

(A.I. Translated Article from Termos e Condições de Housing de Equipamentos)