February 2014 - Core-other - mailman3.cels.anl.gov

EOL on windows boxes.
by rackow＠anl.gov 25 Feb '14

25 Feb '14

FYI, Doing some web user-agent string digging and see these... 140.221.10.231 "Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.4 (KHTML, like Gecko) Chrome/6.0.481.0 Safari/534.4" 140.221.3.32 "Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.4 (KHTML, like Gecko) Chrome/6.0.481.0 Safari/534.4" With XP coming to an end, DOE-HQ is hot to make it all go away. While indicating XP, they are also running an ancient version of Chrome. Can those machines get updated soon?

2 2

Mail loop for Ti?
by John Valdes 24 Feb '14

24 Feb '14

Maybe this is part of Craig's breaking of Zimbra, but if not and its something else that's broken, I'm guessing Ti would like it fixed? :) See attached. John

2 1

What's Craig breaking now? Zimbra!
by Stacey, Craig J. 24 Feb '14

24 Feb '14

In prep for Zimbra going away realsoonnow, I'm going to be removing bits and pieces of it from the configs on newman over the next few days. If people report weirdness with e-mail, this *may* be a cause, so let me know if there are reports of weirdness. -- Craig

1 0

Web indexing
by Leggett, Torrance I. 21 Feb '14

21 Feb '14

Dewey is now indexing almost all the web servers: Wind Wilbur Gust Jenkins-ci Malkovich Woodhick Dewey Spacewalk Caveat Variant Blizzard Squall Dust The following are not being indexed yet: Jenkins Breeze (Not going to) It's also not indexing ftp logs yet though it is getting ftp.mcs.anl.gov http vhost logs. Check it out at https://index.mcs.anl.gov and let me know how it looks and acts.

1 0

where's Linda 2/21-28
by Linda Winkler 21 Feb '14

21 Feb '14

2/21 afternoon WFH 2/24-26 travel to SLAC for ESCC meeting 2/27 arrive home 5am./ WFH 2/28 VACATION lw

1 0

Fwd: Urgent... Adobe Flash has another fix.
by John Roberts 21 Feb '14

21 Feb '14

Added update to Casper and Linux desktops have the latest. -- John Roberts Argonne National Laboratory Desktop/Network Support MCS/CLS/LCF jeroberts(a)anl.gov Begin forwarded message: > From: Gene Rackow <rackow(a)anl.gov> > Subject: Urgent... Adobe Flash has another fix. > Date: February 20, 2014 at 8:51:24 PM CST > To: <cyber911(a)anl.gov> > Cc: <rackow(a)anl.gov> > > This notice hit Adobe's site today. > http://helpx.adobe.com/security/products/flash-player/apsb14-07.html > > Basicly if you have Flash installed, it needs to be updated. > > Since Flash is also built into Internet Explorer 10 and 11, as well > as the lastest version of Chrome, those too need to be updated if installed on > the system. > > People do need to be aware of this and apply patches to their personal machines as well. > > Following that alert came a message from DOE-JC3 indicating there IS an exploit > in the wild. It appears a number of sites are providing an injected iframe > to direct the browser to go to a malware site in the background to infect > the machine. Some public technical details on this can be found at: > > http://www.fireeye.com/blog/technical/targeted-attack/2014/02/operation-gre… > > --Gene > > /~\ The ASCII Gene Rackow email: rackow(a)anl.gov > \ / Ribbon Campaign Cyber Security Office voice: 630-252-7126 > X Against HTML Argonne National Lab > / \ Email! 9700 S. Cass Ave. / Argonne, IL 60439 > > _______________________________________________ > cyber911 mailing list > cyber911(a)lists.anl.gov > https://lists.anl.gov/mailman/listinfo/cyber911

1 0

Sitting on 55
by Tina Stanton-Piersanti 21 Feb '14

21 Feb '14

If I am not there by 8:30 can someone sit at the desk until I get there. T Sent from my iPhone

2 1

Where's Max?
by Adam Trefonides 20 Feb '14

20 Feb '14

On Feb 28th I'll need to take 1/2 family sick day. I will be at the lab from 8:30 - 12 Noon, and then will be gone for the rest of the day. Thanks -- Adam Max Trefonides MCS Systems maxadam(a)mcs.anl.gov

1 0

The rain has let up a bit...
by Stanton-Piersanti, Tina Joy 20 Feb '14

20 Feb '14

I need to go take my lunch now. I need to go pick up some trophies at Award Emblem off of 55 & 53. I’ll be back shortly. T.

1 0

INFO: Watch List for incident INC0012028 is now complete
by Argonne Service Desk 20 Feb '14

20 Feb '14

Date: 2014-02-20 08:21 CST Complete Time: 2014-02-20 11:49 CST Number: INC0012028 State: Complete Click here to view Incident: INC0012028 Short Description: Re: banned from the lab network Description: received from: devoid(a)anl.gov I haven't seen any blocks although I'm not sure if we're getting emails for the 140.221.64.0/22 network or not. That's the one that Ryan was running ~50 ssh session tests against. Forwarding to MCS core and CIS. On Wednesday, February 19, 2014, Ryan Aydelott <ryan.aydelott(a)gmail.com> wrote: > namby, vm's, jabber, anl.gov website - etc - I was running a few chunks > of SSH sessions spewing test results - I'm wondering if I didn't get > blocked by some IDS somewhere - who might I talk to to get removed from > this dark place as it's impossible to WFH now without network trickery (re: > tor) and I would rather not dump lab traffic through such a thing raising > our profile > > > -ryan > The incident you were added to the watch list is now complete. Thank you, CIS Service Desk 630-252-9999 option 2 2014-02-20 11:53 CST - Eugene RackowCustomer Comments What address is he coming from? Without that it's hard to search for the problem. 2014-02-20 11:49 CST - Matthew KwiatkowskiCustomer Comments We pulled the IP this morning and are seeing what we can do with the detection algorithm with networking. Ref:MSG0048244

1 0