May 2014 - Core-other - mailman3.cels.anl.gov

userbase2 cross domain account name uniqueness
by John Valdes 04 Jun '14

04 Jun '14

Hi Ti, I'm trying to create an account in the LCRC domain in userbase2 for Xiaoliang Zhong, an ANL Postdoc in MSD. His ANL username is "zhongx" which isn't used in LCRC (or MCS), so I'd like to use that as his LCRC account name (that's the name he chose in his account request). However, that account name is in use in the CI domain by ID Xiang Zhong (aka Sally Zhong) who appears to be a different person, and so userbase2 (via sovereign) isn't allowing me to use zhongx as Xiaoliang Zhong's account name in the LCRC domain. Is it possible to remove the requirement that account names be unique across domains in userbase2? Or at least between CI and ANL domains (the latter being MCS, LCRC and Kbase), as having unique account names within ANL would be desirable I think (when approving accounts for LCRC, I try to use the person's ANL username or MCS account name if they have one of the latter). Or will allowing non-unique account names between CI and ANL cause problems? Alternately, in this specific case, it looks like Xiang Zhong in CI is an old account (from 2012) and was denied every resource she requested (except Zimbra Mail), so if that account isn't active in CI, maybe we could rename it and/or purge it from userbase2 and free up zhongx as an account name? Otherwise, I'll assign a different account name to Xiaoliang Zhong for his LCRC account. John

2 3

Where's Ti?
by Leggett, Torrance I. 30 May '14

30 May '14

Next Wednesday I'll be working home.

1 0

Monday - WFH
by Stanton-Piersanti, Tina Joy 30 May '14

30 May '14

All- I am going to WFH on Monday in the morning and afternoon - between going to Vinnie’s 4th grade picnic at school. I will be online early Monday and then leave around 10:15 to go to the school and after I get home, will be back online again. Tina

1 0

Will be late..
by Stanton-Piersanti, Tina Joy 30 May '14

30 May '14

Joe didn't get home until 2:30 am from work, I have to take Vin to school- to let him sleep in. I have HD this morning. If someone can take it till I get there, it would be greatly appreciated. T Sent from my iPhone

1 0

where's Linda 5/30
by Linda Winkler 29 May '14

29 May '14

Vacation day please lw

1 0

where's Linda 5/27
by Linda Winkler 27 May '14

27 May '14

Vacation day please lw

3 3

FW: Scavenger - Vulnerabilities that are Overdue or close to Overdue for MCS (8)
by Stacey, Craig J. 22 May '14

22 May '14

Can the owners of the systems highlighted below please login to Scavenger and enter a relevant response. The options are: * Addressed: You have fixed the issue * Accepted: You acknowledge the issue and accept the risk of this. This is the correct choice, for example, if you're going to replace the machine/software/etc. within a short time period. Just note that in the acceptance notice. * False positive: Obvious To stress, you don't have to *fix* it right away, but we need to get them acknowledged in some fashion in the DB. -- Craig From: CIS CSPO service account for scavenger app [mailto:[email protected]] Sent: Thursday, May 22, 2014 7:00 AM To: rackow(a)mcs.anl.gov; Stacey, Craig J.; Trefonides, Adam A.; Raffenetti, Kenneth J.; Murphy-Olson, Daniel E.; Roberts, John E.; Leggett, Torrance I.; Matthews, Thomas P., Jr. Cc: Kwiatkowski, Matthew A.; Skwarek, Michael A. Subject: Scavenger - Vulnerabilities that are Overdue or close to Overdue for MCS (8) Importance: High Cyber Security Program Office Continuous Scanning Project - Scavenger Type of Scan: Summary Vulnerability Report (Contains Outside FW, Inside FW and Daily Scan Results) ________________________________ The following list of vulnerabilities were identified by the Cyber Security continuous scanning project for hosts that you are responsible for. These vulnerabilities identified are to be answered within a specified timeframe. High Vulnerabilities will need to be answered in 10 working days and Medium Vulnerabilities need to be answered in 20 working days and finally Low Vulnerabilities need to be answered in 45 days. The color codes below give you a quick reference to the ones that need immidiate attention. The Red color code means the Vulnerability is soon to be due(10% left) or past due. The Orange color code means that the Vulnerability has only 40% of the time remaining. The online tracking system of Scavenger ranks the vulnerabilities according to their risk. Please address these vulnerabilities as soon as possible and record your actions in the online tracking system located at https://webapps.inside.anl.gov/scavenger/ .<https://webapps.inside.anl.gov/scavenger/> Type Host DNS Last Seen Vulnerable Vulnerability Risk Days Left for Answer Full Monthly Scan 140.221.84.108 140.221.84.108 2014-05-10 21:00:02 Unsupported Unix Operating System High 1 Full Monthly Scan 140.221.84.207 140.221.84.207 2014-05-10 21:00:02 CGI Generic Command Execution (time-based) High 1 Full Monthly Scan 140.221.84.217 140.221.84.217 2014-05-10 21:00:02 Unsupported Unix Operating System High 1 Full Monthly Scan 140.221.85.76 140.221.85.76 2014-05-10 21:00:02 Unsupported Unix Operating System High 1 Full Monthly Scan 140.221.85.85 140.221.85.85 2014-05-10 21:00:02 Unsupported Unix Operating System High 1 Full Monthly Scan 140.221.9.101 gnep.mcs.anl.gov 2014-05-03 21:00:02 Secure HyperText Transfer Protocol (S-HTTP) Detection Medium 6 Full Monthly Scan 140.221.9.101 gnep.mcs.anl.gov 2014-05-03 21:00:02 .svn/entries Disclosed via Web Server Medium 6 Full Monthly Scan 140.221.84.3 mmgt2.mcs.anl.gov 2014-05-10 21:00:02 OpenSSL Heartbeat Information Disclosure (Heartbleed) High 1 The following email was generated by the CSPO system Scavenger. If you have any questions regarding this email or the system, please contact scavenger(a)anl.gov<mailto:[email protected]> or via phone at 2-3456.

2 2

Interviewing for Sr. Sysadmin candidates
by Stacey, Craig J. 22 May '14

22 May '14

I expect we'll start the in-person interviewing for our Sr. Sysadmin posting the week of June 2. I've come up with the following list of interviewers. In each case, I'm figuring a 45 minute interview slot except where noted. If you aren't on the list and want on, or if you have other proposed changes, let me know. I'm waiting to hear back from MCS Scientific Staff for other researchers who may want to talk to the candidates. For this position, we're looking for a solid sysadmin who can work on just about anything in our environment, though I expect around half of the effort to be happening in the Magellan space. Development experience would be a plus. Thanks! Me: 30 minute start, 30 minute closeout Ti Max & John R Dan Scott Devoid & Ryan Aydelott: 60 mins John V & John B Folker Jared Bischof and Andreas Wilke Tom Brettin -- Craig

1 0

FW: Sandwiches
by Stanton-Piersanti, Tina Joy 21 May '14

21 May '14

Whoever goes down, get me one for lunch todayŠ I am starving.. Thanks! Tina On 5/21/14, 1:14 PM, "Gregurich, Susan R." <Gregurich(a)anl.gov> wrote: >Hey Tina, > >I just put six turkey sandwiches in the refrigerator down in the >conference center. If you know of anyone that would like to take one home >for dinner or lunch tomorrow, would you let them know and ask them to put >them in a different refrigerator so everyone knows that they are >accounted for? > >Sue

2 2

FW: INC0014137
by Stacey, Craig J. 21 May '14

21 May '14

Props to Christiaan for getting this. Once it's in place, any authenticated user will be able to send from any address. -- Craig From: Zaluzec, Christiaan N. Sent: Wednesday, May 21, 2014 1:00 PM To: Stacey, Craig J. Subject: RE: INC0014137 Craig, It took a full day of digging to find the appropriate AD permission and the right spot in which to set it, but I got this to work to my satisfaction in our test environment. Even better, I was able to find a way to set it for all authenticated users, so no need for Isaac groups or custom requests. I ran it by Cyber and they are ok with the change. I still need to submit an RFC to change management, but the change does not require a reboot or service interruption, so I see no reason why it won't get approved in a timely manner. We usually have a three day lead time on change requests, so I'd expect this will be in place by early next week. Keep in mind this feature is only going to apply to IMAP/POP clients leveraging smtp.anl.gov. MAPI/ActiveSync/web clients will still default to the primary email address on the account as whom you are trying to send. CalDav is next on my priority list. The Unix team has set up a VM for it and we will be getting started on that early next week as well. Christiaan From: Stacey, Craig J. Sent: Wednesday, May 21, 2014 10:20 AM To: Zaluzec, Christiaan N. Subject: RE: INC0014137 That's awesome. Thanks! -- Craig From: Zaluzec, Christiaan N. Sent: Wednesday, May 21, 2014 10:19 AM To: Stacey, Craig J. Subject: RE: INC0014137 Ok, I'll do testing and see if applying permissions via a group is possible, and if it is, we'll go from there. If not, I'll just bulk add all of your users and we'll just need to establish a request process for any new users who require that capability. Christiaan From: Stacey, Craig J. Sent: Wednesday, May 21, 2014 10:17 AM To: Zaluzec, Christiaan N. Subject: RE: INC0014137 That's good news. I'm not aware of an ISAAC group configured that way. I can request one. -- Craig From: Zaluzec, Christiaan N. Sent: Wednesday, May 21, 2014 10:01 AM To: Stacey, Craig J. Subject: RE: INC0014137 Craig, I believe I've found a way to allow your users to send as any email address, but I have to test it. I plan to do that today in our dev environment. The trick is that it's not something I can set globally on the SMTP connector. I have to enable it for individual users (or hopefully groups of users). Kind of stupid if you ask me, but that's the only option I have. Does there happen to be an ISSAC group or groups that contain all MCS, CLS, and LCF employees? If so, that might make getting it enabled a whole lot faster, and prevent us from having to update the permissions list every time a new users is enabled. Christiaan From: Stacey, Craig J. Sent: Tuesday, May 20, 2014 12:39 PM To: Zaluzec, Christiaan N. Subject: RE: INC0014137 Yes, thanks. -- Craig (mobile) -----Original Message----- From: Zaluzec, Christiaan N. [CZaluzec(a)anl.gov] Received: Tuesday, 20 May 2014, 12:13PM To: Stacey, Craig J. [stace(a)anl.gov] Subject: Re: INC0014137 So, from Rick's perspective, since the ci email goes to his Exchange mailbox, we can just add that address to his Exchange mailbox, which will permit him to send as that address. I will still investigate the ability to enable "send as anyone", but this solution will at least get Rick working the way he needs to be. Sound acceptable? Thanks, Christiaan Zaluzec On May 20, 2014, at 10:42 AM, "Stacey, Craig J." <stace(a)anl.gov<mailto:[email protected]>> wrote: It's not universal. Some forward to ANL, some forward to gmail, some forward to UofC's exchange server. Rick's, for example, forwards to stevens(a)anl.gov<mailto:[email protected]>. Many forward to user(a)mcs.anl.gov<mailto:[email protected]> (which, in turn, forwards to either anlmail or elsewhere). -- Craig From: Zaluzec, Christiaan N. Sent: Tuesday, May 20, 2014 10:41 AM To: Stacey, Craig J. Subject: Re: INC0014137 So do ci.uchicago.edu<http://ci.uchicago.edu> addresses now forward to personal email addresses? Can they forward back to exchange mailboxes instead? If so, we can add it as an acceptable domain on exchange and effectively permit sending as that address. Thanks, Christiaan Zaluzec On May 20, 2014, at 10:31 AM, "Stacey, Craig J." <stace(a)anl.gov<mailto:[email protected]>> wrote: No, CI mail used to be handled by Zimbra, which went away, so now all ci.uchicago.edu<http://ci.uchicago.edu> addresses are simply aliases to other services (as are MCS, LCF, etc.). I suspected this might be the case, and I fear that there will either be no movement on the "allow authenticated users to send as anyone" request, or it will be glacial, since I requested this some time ago. I'm going to move forward on getting our mail relays to auth against ANL AD/LDAP and set those to allow "send as anyone", and point our users who need that ability at them. I'd hoped to avoid doing this, since we were ostensibly getting out of the business of being an e-mail provider, but it looks like there's a couple of items in our general workflow that are incompatible with Argonne's expectations. -- Craig From: Zaluzec, Christiaan N. Sent: Tuesday, May 20, 2014 10:28 AM To: Stacey, Craig J. Subject: INC0014137 Craig, Regarding your request to permit Rick to send as stevens(a)ci.uchicago.edu<mailto:[email protected]> Is there not currently a server that hosts these mailboxes? Can his client be configured to use multiple smtp servers? Here's the issue. To permit him to send as that address I have to add that address to his mailbox. This will work, however once I do that, mail sent to stevens(a)ci.uchicago.edu<mailto:[email protected]> from within Exchange will go to his Exchange mailbox, not the ci.uchicago.edu<http://ci.uchicago.edu> mailbox Additionally, I 'll escalate the request to be able to send as unhosted SMTP addresses and investigate options today. Christiaan

1 0