February 2011 - Core-other - mailman3.cels.anl.gov

Re: SSH blocks on 128.135.100.102
by Schmitz Corby 28 Feb '11

28 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 No idea. Someone else will have to speak on his/her behalf. - -corby On Feb 28, 2011, at 3:43 PM, Gene Rackow wrote: > Corby, > To fill in some details... > It looked like someone was attempting to brute force their way into the globuscvs server. > Tried russell, them mrussell then back to russell again. No valid logins happened to reset > the counters during those attempts, so the block went it. When it did, email was sent > about the problem. to: compsec(a)anl.gov, maxadam(a)mcs.anl.gov, bradshaw(a)mcs.anl.gov, > stace(a)mcs.anl.gov, raffenet(a)mcs.anl.gov, valdes(a)mcs.anl.gov, hunter(a)mcs.anl.gov > > In looking back through the logs for this month, it appears that russell had the same sort > of probkem on Feb 11, but stopped short of getting blocked. I don't see a valid login for > anything with russel at all this month from there at all. Who is this person? > There was also a number of failures from marek on Feb 14 to login1 and JunFan on Feb 21 > attempting to get onto login1.intrepid. I don't see corresponding fuzzy matches marek, > I do see a couple logins for JunFan. > > Hopefully someone can stomp on russell or mrussell, or ??? so he doesn't cause > future issues. Note the timing on this is something that would imply this is > a person at the keyboard as well with repeated failures. > > Feb 22 10:09:38 192.5.186.90 sshd[22838]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.135.100.102 user=anonymous > Feb 22 10:09:47 192.5.186.90 sshd[22844]: Illegal user russell from ::ffff:128.135.100.102 > Feb 22 10:09:47 192.5.186.90 sshd[22844]: Failed none for illegal user russell from ::ffff:128.135.100.102 port 58349 ssh2 > Feb 22 10:09:49 192.5.186.90 sshd[22844]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.135.100.102 > Feb 22 10:09:55 192.5.186.90 sshd[22844]: error: PAM: User not known to the underlying authentication module for illegal user russell from 128.135.100.102 > Feb 22 10:09:55 192.5.186.90 sshd[22844]: Failed keyboard-interactive/pam for illegal user russell from ::ffff:128.135.100.102 port 58349 ssh2 > Feb 22 10:10:03 192.5.186.90 sshd[22856]: Illegal user mrussell from ::ffff:128.135.100.102 > Feb 22 10:10:03 192.5.186.90 sshd[22856]: Failed none for illegal user mrussell from ::ffff:128.135.100.102 port 53901 ssh2 > Feb 22 10:10:05 192.5.186.90 sshd[22856]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.135.100.102 > Feb 22 10:10:11 192.5.186.90 sshd[22860]: Illegal user mrussell from ::ffff:128.135.100.102 > Feb 22 10:10:11 192.5.186.90 sshd[22860]: Failed none for illegal user mrussell from ::ffff:128.135.100.102 port 59797 ssh2 > Feb 22 10:10:18 192.5.186.90 sshd[22860]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.135.100.102 > Feb 22 10:10:21 192.5.186.90 sshd[22906]: Illegal user mrussell from ::ffff:128.135.100.102 > Feb 22 10:10:21 192.5.186.90 sshd[22906]: Failed none for illegal user mrussell from ::ffff:128.135.100.102 port 19817 ssh2 > Feb 22 10:10:25 192.5.186.90 sshd[22906]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.135.100.102 > Feb 22 10:10:47 192.5.186.90 sshd[22923]: Illegal user mrussell from ::ffff:128.135.100.102 > Feb 22 10:10:47 192.5.186.90 sshd[22923]: Failed none for illegal user mrussell from ::ffff:128.135.100.102 port 51386 ssh2 > Feb 22 10:11:00 192.5.186.90 sshd[22923]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.135.100.102 > Feb 22 10:11:03 192.5.186.90 sshd[22931]: Illegal user mrussell from ::ffff:128.135.100.102 > Feb 22 10:11:03 192.5.186.90 sshd[22931]: Failed none for illegal user mrussell from ::ffff:128.135.100.102 port 37887 ssh2 > Feb 22 10:11:11 192.5.186.90 sshd[22937]: Illegal user russell from ::ffff:128.135.100.102 > Feb 22 10:11:11 192.5.186.90 sshd[22937]: Failed none for illegal user russell from ::ffff:128.135.100.102 port 48121 ssh2 > Feb 22 10:11:14 192.5.186.90 sshd[22937]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.135.100.102 > Feb 22 10:11:20 cavespider.it.anl.gov sshd: sshd NFCOLLECTOR blocked 128.135.100.102 1298391079 604800 IDS Ssh 3 SSH: illegal username login attempts over 3 times > > > ------- Forwarded Message > > To: compsec(a)anl.gov, maxadam(a)mcs.anl.gov, bradshaw(a)mcs.anl.gov, > stace(a)mcs.anl.gov, raffenet(a)mcs.anl.gov, valdes(a)mcs.anl.gov, > hunter(a)mcs.anl.gov > Subject: SSH Monitoring Tool: SSH: illegal username login attempts over 3 > times - Block Issued > Message-Id: <20110222161119.816F614064(a)cavespider.it.anl.gov> > Date: Tue, 22 Feb 2011 10:11:19 -0600 (CST) > From: nfcollector(a)anl.gov (Account for netflows) > X-Mailman-Version: 2.1.14 > Precedence: list > Reply-To: csadmin(a)anl.gov > > Number of notices on this incident: 1 > > Unauthorized attempt on ssh server. > 128.135.100.102: Sent to Guardian to block for 168 hours due to SSH: illegal username login attempts over 3 times. > > - -- LOG ENTRY -- > > Feb 22 10:10:47 192.5.186.90 sshd[22923]: Illegal user mrussell from ::ffff:128.135.100.102 > > - -- USER -- > > User Information: > The username, mrussell, is registered to: > Name: Michael P. Russell > Email: > Phone: (630) 252-4779 > Badge: 53220 > Room: OFFSITE > <a href = "http://www.anl.gov/cgi-bin/anl/net/people.csh?function=Find+Badge%3A&string…"> More information</a> > > - -- SOURCE -- > > Host Information: > Information for host, 128.135.100.102: > IP: 128.135.100.102 ((unregistered)) > MAC: > First Seen: > Last Seen: > Closest Switch: > > VPN Information: > 128.135.100.102 is not a VPN address > > Wireless Information: > 128.135.100.102 is not a wireless address > > - -- DESTINATION -- > > Host Information: > Information for host, 192.5.186.90: > IP: 192.5.186.90 (globuscvs.mcs.anl-external.org) > MAC: 001125ac5244 > First Seen: 9-17-2007 14:15:8 > Last Seen: 2-22-2011 10:10:18 > Closest Switch: > > VPN Information: > 192.5.186.90 is not a VPN address > > Wireless Information: > 192.5.186.90 is not a wireless address > > - -- NETWORK INFORMATION ON SOURCE -- > > Network Information: > The IP, 128.135.100.102, not found in Networking database > > Switch Information: > Information for switch, 130.202.228.31: > Switch: 130.202.228.31 (prism1v666.aps.anl.gov) > Port Number (Name): () > Speed Duplex: > Switch Location: > First Seen: > Last Seen: > > - -- NETWORK INFORMATION ON DESTINATION -- > > Network Information: > The IP, 192.5.186.90, was found in Networking database > Subnet: 192.5.176.0/20 > Division: CIS > VLAN: 0 > Enclave: > OSPF: tier1 > Color: > Description: > NetAdmin: () > No information found for , probably an illegal name. > CSPR: Matt Kwiatkowski (mattk) > The username, mattk, is registered to: > Name: Matthew A. Kwiatkowski > Email: mattk(a)anl.gov > Phone: (630) 252-6465, (630) 229-2928 > Badge: 51066 > Room: 240 4110 > <a href = "http://www.anl.gov/cgi-bin/anl/net/people.csh?function=Find+Badge%3A&string…"> More information</a> > > Switch Information: > Information for switch, 10.140.132.65: > Switch: 10.140.132.65 (hpc-221sw) > Port Number (Name): () > Speed Duplex: > Switch Location: > First Seen: 8-25-2008 16:18:7 > Last Seen: 12-12-2008 9:18:3 > > *Note: This email was generated by an application in the CIS/Networking Group. For assistance, contact the Networking Group through the Help Desk at 2-9999 or compsec(a)anl.gov. > > ------- End of Forwarded Message > -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.16 (Darwin) iD8DBQFNbBuHQhpwH3ALVFERAr+lAJ4uH7cJyAlbOeHX2P+Ovq0aIyB0jACg2Jxo TCCo9POZZwv4bF11aZ/GXiU= =fif7 -----END PGP SIGNATURE-----

1 0

Where's Dan?
by Dan Olson 28 Feb '11

28 Feb '11

My house decided to give me an indoor pool today. I am taking at least the morning off to deal with it. ---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055

1 0

Re: coredb-2 PROBLEM!
by Schmitz Corby 27 Feb '11

27 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is this something serious? It looks like coredb-2 is down. - -corby On Feb 27, 2011, at 10:25 AM, Nagios on Watcher wrote: > ***** Nagios on watcher ***** > > Notification Type: PROBLEM > Host State: DOWN > Host: coredb-2 > State: DOWN > Address: 140.221.7.8 > Info: CRITICAL - 140.221.7.8: rta nan, lost 100% > > Date/Time: Sun Feb 27 10:25:34 CST 2011 > URL: https://watcher.mcs.anl.gov/mcs/nagios/cgi-bin/extinfo.cgi?type=1&host=core… -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.16 (Darwin) iD8DBQFNan+EQhpwH3ALVFERAserAJ0RpaUU9SbytEYP9dkLwv+0L51N3wCgj/e+ 8oZELIiarl6PJjE0f87yTYg= =gZHv -----END PGP SIGNATURE-----

3 2

Where's Max?
by Max trefonides 27 Feb '11

27 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 My wife's Volvo has serious engine trouble and I need to go get my family in Appleton WI. They are there through Tuesday, so I need to take Tomorrow and Tuesday to get them. I will be online, but please count this as two 1/2 days vacation. Thanks, sorry for the lack of notice. - -- max -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (Darwin) iEYEARECAAYFAk1qnlQACgkQaPBbFuCp8UJMEwCghcJqTHUTiZgx4+nw8dtOmf94 zioAnjEeviawt13uSa+/ZRffbUs8CQLF =wAff -----END PGP SIGNATURE-----

1 0

Output from "cron" command
by Super-User 27 Feb '11

27 Feb '11

Your "cron" job on mercury /usr/lib/fs/nfs/nfsfind produced the following output: find: stat() error /exports/proj-fischer00/fischer/pc/00000001.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc/00000002.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc/My Music/00000002.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc/My Music/00000001.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc/My Pictures/RR/DMIR_6/DMIR222a.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc/My Pictures/RR/DMIR_6/DMIR222b.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/00000001.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/nek5n/doc/movies: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/My Music/00000002.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/My Music/00000001.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/My Pictures/RR/DMIR_6/DMIR222b.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/My Pictures/RR/DMIR_6/DMIR222a.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/00000002.JPG: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/contribtest/datatypes/bc6/bcr0c1.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/contribtest/datatypes/bc1/bcr0c1.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/contribtest/datatypes/bc5/bcr0c1.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/contribtest/datatypes/bc10/bcr0c1.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/contribtest/datatypes/bc2/bcr0c1.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/contribtest/datatypes/bc8/bcr0c1.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/contribtest/datatypes/bc0/bcr0c1.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/contribtest/datatypes/bc7/bcr0c1.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/contribtest/datatypes/bc9/bcr0c1.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/contribtest/datatypes/bc3/bcr0c1.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/contribtest/datatypes/bc11/bcr0c1.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/contribtest/datatypes/bc4/bcr0c1.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/perftest/long.err: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/examples/perftest/lrtestf.c: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/mpid/ch_nexus/nexus-rm/quickthreads/md/null.README: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/mpid/ch_nexus/nexus-rm/data_conversion/stamp-h.in: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/mpid/ch_nexus/nexus-rm/ports0/stamp-h.in: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/mpid/ch_nexus/nexus-rm/ports0/p0_th_null_i.h: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/mpid/ch_nexus/nexus-rm/ports0/p0_th_null.h: Value too large for defined data type find: stat() error /exports/shared/nt-homes001/lusk/mpich/mpid/ch_nexus/nexus-4.0b4/config/CONFIG: Value too large for defined data type

1 0

Re: [CELS Sysadmins] [systems] [HPC-Admins] Beer suggestion
by Craig Stacey 25 Feb '11

25 Feb '11

We're seated in the restaurant. Sent from my mobile -----Original message----- From: Craig Stacey <stace(a)mcs.anl.gov> To: Chris Walker <cwalker(a)mcs.anl.gov> Cc: Andrew Cherry <acherry(a)alcf.anl.gov>, sysadmins(a)cels.anl.gov, John Valdes <valdes(a)mcs.anl.gov> Sent: Fri, Feb 25, 2011 23:52:10 GMT+00:00 Subject: Re: [CELS Sysadmins] [systems] [HPC-Admins] Beer suggestion K, let's go to Gordon Biersch. I'm leaving at 6. On Feb 25, 2011, at 5:51 PM, Chris Walker wrote: > either is good w/ me too > > On Feb 25, 2011, at 5:49 PM, Andrew Cherry wrote: > >> Either place is fine with me. >> >> ----- Original Message ----- >> From: "Craig Stacey" <stace(a)mcs.anl.gov> >> To: "John Valdes" <valdes(a)mcs.anl.gov> >> Cc: sysadmins(a)cels.anl.gov >> Sent: Friday, February 25, 2011 5:34:28 PM >> Subject: Re: [systems] [CELS Sysadmins] [HPC-Admins] Beer suggestion >> >> Yeah, GB has a new seasonal on right now. I wouldn't be opposed to it. >> >> On Feb 25, 2011, at 4:41 PM, John Valdes wrote: >> >>> Looks like a good place, but did Mokena get snow last night? It so, >>> that'd make the haul more of a character builder... ;) I vote for >>> somewhere closer himself. Tap House is fine. Does Gordon Biersch have >>> any new seasonals? >>> >>> John >>> >>> On Fri, Feb 25, 2011 at 03:47:50PM -0600, Zachary Mance wrote: >>>> It is a very nice place. I go there often because it is just a skip >>>> away from my house. The food is really tasty. If you are going all >>>> that way out there I will suggest this place as well. >>>> http://www.chefklausbierstube.com/ >>>> >>>> Also, it is about a 30 min drive from the lab if you do NOT take I80 >>>> east, get off at rt 6 it is much quicker specially on a Friday. >>>> On Feb 25, 2011, at 3:34 PM, Craig Stacey wrote: >>>> >>>>> I'm open to anything. Throwing this out there: >>>>> >>>>> http://www.tribesalehouse.com/ >>> _______________________________________________ >>> This is the CELS Sysadmins mailing list. It is sent to memebers of: >>> core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. >>> Do not subscribe directly to this list. Thanks. >> >> _______________________________________________ >> This is the CELS Sysadmins mailing list. It is sent to memebers of: >> core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. >> Do not subscribe directly to this list. Thanks. >> _______________________________________________ >> systems mailing list >> systems(a)lists.alcf.anl.gov >> https://lists.alcf.anl.gov/cgi-bin/mailman/listinfo/systems >> _______________________________________________ >> This is the CELS Sysadmins mailing list. It is sent to memebers of: >> core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. >> Do not subscribe directly to this list. Thanks. >> >> > _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

[CELS Sysadmins] Beer suggestion
by Craig Stacey 25 Feb '11

25 Feb '11

I'm open to anything. Throwing this out there: http://www.tribesalehouse.com/ _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

9 16

where's Linda
by Linda Winkler 25 Feb '11

25 Feb '11

working from home this morning. half day of vacation this afternoon next week Mon-Thur on travel to Seattle lw

1 0

Where's Jason
by Jason Hedden 25 Feb '11

25 Feb '11

Working from home today. My son has been sick most of this week, and it's my turn to stay home with him. - Jason

1 0

where's beth tomorrow?
by Beth Cerny Patino 24 Feb '11

24 Feb '11

Heads up! I'm going to work from home tomorrow. I worked ALL day Sunday, Tuesday night until 11pm and Wednesday night until 11pm all while fighting a head cold and could use a day to organize myself, review notes and research items for Globus site and complete some simple requests. I'll be online. Beth

1 0