July 2014 - Core-other - mailman3.cels.anl.gov

shadowserver at it again.
by rackow＠anl.gov 31 Jul '14

31 Jul '14

Shadow server apears to have been poking around again. This time for UDP port 623. In other works IPMI, asf-rmcp 623/udp ASF Remote Management and Control Protocol My guess is with the recent announcements of IPMI vulns, they are poking to see what may be a problem. Start End Sif SrcIPaddress SrcP DIf DstIPaddress DstP P Fl Pkts Octets 0728.02:02:57.480 0728.02:02:57.480 6 71.6.216.49 49092 3 192.5.186.76 623 17 0 2 102 0728.02:02:57.473 0728.02:02:57.473 6 192.5.186.76 623 3 71.6.216.49 49092 17 0 2 116 0728.15:00:29.468 0728.15:00:29.468 6 71.6.216.49 40825 3 192.5.186.80 623 17 0 2 58 0728.22:42:40.702 0728.22:42:40.702 5 184.105.247.238 41619 3 192.5.186.79 623 17 0 2 102 0728.22:42:40.747 0728.22:42:40.747 6 192.5.186.79 623 3 184.105.247.238 41619 17 0 2 116 0729.23:17:43.465 0729.23:17:43.465 5 184.105.247.250 51163 3 192.5.186.80 623 17 0 2 102 0729.23:17:43.502 0729.23:17:43.502 6 192.5.186.80 623 3 184.105.247.250 51163 17 0 2 116 0730.00:58:44.240 0730.00:58:44.240 5 184.105.247.242 48596 3 192.5.186.79 623 17 0 2 102 0730.00:58:44.290 0730.00:58:44.290 6 192.5.186.79 623 3 184.105.247.242 48596 17 0 2 116 0730.22:38:02.559 0730.22:38:02.559 5 184.105.247.250 47805 3 192.5.186.80 623 17 0 2 102 0730.22:38:02.568 0730.22:38:02.568 6 192.5.186.80 623 3 184.105.247.250 47805 17 0 2 116 0730.23:03:50.334 0730.23:03:50.334 5 184.105.247.250 34362 3 192.5.186.82 623 17 0 2 102 0730.23:03:50.364 0730.23:03:50.364 6 192.5.186.82 623 3 184.105.247.250 34362 17 0 2 116 0730.23:16:26.735 0730.23:16:26.735 5 184.105.247.250 37066 3 192.5.186.79 623 17 0 2 102 0730.23:16:26.785 0730.23:16:26.785 6 192.5.186.79 623 3 184.105.247.250 37066 17 0 2 116 0730.23:33:49.004 0730.23:33:49.004 5 184.105.247.198 36485 3 192.5.186.76 623 17 0 2 102 0730.23:33:50.076 0730.23:33:50.076 6 192.5.186.76 623 3 184.105.247.198 36485 17 0 2 116 The probe from 71.6.216.49 is a "rapid7.com" scanner. A competitor to nessus in may ways. Claims from shadowserver reports are "timestamp","ip","port","hostname","tag","ipmi_version","asn","geo","region","city","none_auth","md2_auth","md5_auth","passkey_auth","oem_auth","defaultkg","permessage_auth","userlevel_auth","usernames","nulluser","anon_login","error","deviceid","devicerev","firmwarerev","version","manufacturerid","manufacturername","productid","productname" "2014-07-28 02:35:00","192.5.186.79",623,"node0.i2u2.org","ipmi","1.5",683,"US","ILLINOIS","LEMONT","no","no","no","no","yes","-","disabled","disabled","yes","no","no",,,,,,,,, "2014-07-29 03:42:41","192.5.186.79",623,"node0.i2u2.org","ipmi","1.5",683,"US","ILLINOIS","LEMONT","no","no","no","no","yes","-","disabled","disabled","yes","no","no",,,,,,,,, "2014-07-30 04:17:43","192.5.186.80",623,"node1.i2u2.org","ipmi","1.5",683,"US","ILLINOIS","LEMONT","no","no","no","no","yes","-","disabled","disabled","yes","no","no",,,,,,,,, "2014-07-30 05:58:43","192.5.186.79",623,"node0.i2u2.org","ipmi","1.5",683,"US","ILLINOIS","LEMONT","no","no","no","no","yes","-","disabled","disabled","yes","no","no",,,,,,,,, --gene

1 0

half-day on Friday
by Henderson, Martino S. 31 Jul '14

31 Jul '14

My son is having a ceremony at his summer camp for the last day. I'll need to leave by noon in order to attend and pick him up. - Martino Henderson Help Desk / System Support Office: +1(630) 252-1692 Argonne National Laboratory Computer, Environment, & Life Sciences 9700 South Cass Avenue Building 240 - 3.E.18 Argonne, Illinois 60439 United States [ANL_Logo]

1 0

Where's JohnR?
by John Roberts 31 Jul '14

31 Jul '14

I'm heading to a car dealer in the morning and expect to be in around noonish. I'll be available by phone if needed. Sent from my T-Mobile 4G LTE Device

1 0

[CELS Sysadmins] Device console cables missing
by Leggett, Torrance I. 29 Jul '14

29 Jul '14

I'm missing console cables for a DDN 6620 and a BNT G8000. The DDN has a regular DB-9 on one end and a 1/8" stereo jack on the other. The BNT has a DB-9 and a mini-USB. If you borrowed these from me, can you return them. If you have the DDN cable can I borrow it for today? I'm dead in the water with replacing the controllers without it. Thanks. _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of core-admins(a)mcs.anl.gov and systems(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

2 1

Working from home.
by Stanton-Piersanti, Tina Joy 29 Jul '14

29 Jul '14

I have to work from home today. Sorry about the late notice. T. Sent from my iPhone

1 0

Where's JohnV next week?
by John Valdes 28 Jul '14

28 Jul '14

Due to a convergence of relatives being in town (from out-of-state and overseas), mother's birthday and vacation accrual overflow, I'm planning to take a few days off next week, most likely Wed, Thu and Fri (7/30-8/1). I'll be in town and will check on things sporadically, but otherwise I'm planning to take those days as "vacation". I'll send an update should plans change. John

1 1

RE: [GeekBeer] Sysadmin day grilling and beer! After work on Friday, July 25
by Stacey, Craig J. 25 Jul '14

25 Jul '14

I'm heading home to do some prep and such, and thus celebrating Sysadmin Day by taking a half day off. Don't sweat it if it rains, we have indoor contingencies. And I've got enough food to feed at least 20-25 people. In fact, bring no snacks or sides. The only thing I don't really have is pop. -- Craig > -----Original Message----- > From: geekbeer-bounces(a)cels.anl.gov [mailto:geekbeer- > bounces(a)cels.anl.gov] On Behalf Of Stacey, Craig J. > Sent: Thursday, July 24, 2014 10:51 AM > To: geekbeer(a)lists.cels.anl.gov > Subject: Re: [GeekBeer] Sysadmin day grilling and beer! After work on > Friday, July 25 > > Realize I forgot to include my address in case you don't have it. > > 7317 W 58th Pl. > Summit, IL 60501. > > -- > Craig > > > -----Original Message----- > > From: geekbeer-bounces(a)cels.anl.gov [mailto:geekbeer- > > bounces(a)cels.anl.gov] On Behalf Of Stacey, Craig J. > > Sent: Tuesday, July 22, 2014 9:16 AM > > To: geekbeer(a)lists.cels.anl.gov > > Subject: [GeekBeer] Sysadmin day grilling and beer! After work on > > Friday, July 25 > > > > Friday! Sysadmin Appreciation day! > > > > http://wwwstatic.spiceworks.com/img/marketing/infographic/sysadmin- > > day.png > > http://sysadminday.com/ > > > > I appreciate the hell out of Sysadmins! Tisha and I both do! So, > > hey, we'll buy y'all a beer. > > > > So, yeah, come to our house after work on Friday. We'll have beer, > > various meats (and non-meats for those so inclined) for grilling, > > plenty of beer including the most recent batch of Smokesquatch! I may > > grab a growler or two of Imperial Oak beer on the drive home, too. > > > > We'll hang out in the back yard, have a fire, it'll be a hoot and a > > half. Bring yourself, bring a guest or two. Feel free to bring along > > a snack or side, or some sodee pop. > > > > I don't need a hard RSVP on this, but if I have a head count by > > Thursday end of day it'll help me make sure I have enough burgers and > such. > > -- > > Craig > > > > > -----Original Message----- > > > From: geekbeer-bounces(a)cels.anl.gov [mailto:geekbeer- > > > bounces(a)cels.anl.gov] On Behalf Of Stacey, Craig J. > > > Sent: Tuesday, July 08, 2014 1:42 PM > > > To: geekbeer(a)lists.cels.anl.gov > > > Subject: [GeekBeer] Save the date, Sysadmin day is July 25 > > > > > > In honor of Sysadmin Appreciation day on 7/25, Tisha and I are going > > > to host a geekbeer grill & drink session at our house. More details > > > to come, but the short story is once work's done, come over to our > > > place and kick back with your fellow geeks. We'll do games and stuff. > > > > > > -- > > > Craig > > > > > > _______________________________________________ > > > GeekBeer mailing list > > > GeekBeer(a)cels.anl.gov > > > https://lists.cels.anl.gov/mailman/listinfo/geekbeer > > _______________________________________________ > > GeekBeer mailing list > > GeekBeer(a)cels.anl.gov > > https://lists.cels.anl.gov/mailman/listinfo/geekbeer > _______________________________________________ > GeekBeer mailing list > GeekBeer(a)cels.anl.gov > https://lists.cels.anl.gov/mailman/listinfo/geekbeer

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 24 Jul '14

24 Jul '14

This is the mail system at host mailrelay.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <jarrard.marcell(a)gmail.com>: host gmail-smtp-in.l.google.com[74.125.142.26] said: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 i4si13523igj.19 - gsmtp (in reply to RCPT TO command)

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 24 Jul '14

24 Jul '14

This is the mail system at host mailrelay.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <dorota.porazinska(a)clorado.edu>: Host or domain name not found. Name service error for name=clorado.edu type=A: Host not found

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 24 Jul '14

24 Jul '14

This is the mail system at host mailrelay.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <jarrard.marcell(a)gmail.com>: host gmail-smtp-in.l.google.com[74.125.142.26] said: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 s11si17491766ich.19 - gsmtp (in reply to RCPT TO command)

1 0