July 2014 - Core-other - mailman3.cels.anl.gov

where's Linda
by Linda Winkler 16 Jul '14

16 Jul '14

working from home this morning in order to make a 10am dr appt lw

1 0

Where's Martino
by Henderson, Martino S. 16 Jul '14

16 Jul '14

I'm running late and will be in around 9:30. Sent from my Android mobile device Martino Henderson CELS System Support

1 0

Sitting on 55 at Renwick
by Stanton-Piersanti, Tina Joy 16 Jul '14

16 Jul '14

Looks backed up to veterans pkwy - be there soon Sent from my iPhone

1 0

Where's Craig
by Stacey, Craig J. 14 Jul '14

14 Jul '14

I have a dentist appointment this morning which means I'll be leaving around 945 and will miss the CI sync. I should be back around 1130ish. -- Craig (mobile)

1 0

Where's Kevin
by Walker, Kevin L. 14 Jul '14

14 Jul '14

I’ll be late today, have a doctors appointment at 9am that I forgot about, should be in no later than 10:30am. thanks. Kevin Walker Argonne National Laboratory CELS Systems Klwalker(a)anl.gov

1 0

Where's JohnR?
by John Roberts 11 Jul '14

11 Jul '14

I’ll be taking 2 vacations days Monday and Tuesday, 7/21-22. thanks. -- John Roberts Argonne National Laboratory CELS Systems jeroberts(a)anl.gov

1 0

FW: [email protected] and ServiceNow
by Stacey, Craig J. 11 Jul '14

11 Jul '14

To pilot Service Now as a possible RT replacement for Systems, we're going to point help(a)cels.anl.gov<mailto:[email protected]> (a largely unknown alias at this point) at the Service Now queue. Once it's live, we'll start quietly promoting it as a help address among the CELS front office. Assuming it goes well, we can start migrating more people to using that address and slowly phase out systems@mcs as the main one, until it ultimately becomes an alias to help@cels. -- Craig From: Schmidt, Jack C. Sent: Friday, July 11, 2014 12:59 PM To: Stacey, Craig J. Cc: Hurst, Justin D.; Podoba, Gregory M. Subject: RE: help(a)cels.anl.gov and ServiceNow Works for me! From: Stacey, Craig J. Sent: Friday, July 11, 2014 12:49 PM To: Schmidt, Jack C. Cc: Hurst, Justin D.; Podoba, Gregory M. Subject: RE: help(a)cels.anl.gov<mailto:[email protected]> and ServiceNow Sounds good. Let's set the start to go live on Wednesday morning? I'll have the components on my end ready to roll then. -- Craig From: Schmidt, Jack C. Sent: Friday, July 11, 2014 12:46 PM To: Stacey, Craig J. Cc: Hurst, Justin D.; Podoba, Gregory M. Subject: help(a)cels.anl.gov<mailto:[email protected]> and ServiceNow Craig, Hi! Are you ready to have email sent to help(a)cels.anl.gov<mailto:[email protected]> create tickets within servicenow and have them assigned to the "Service Desk (CELS)" group - which consists of your team? If so then we need to: 1) Activate the Service Desk (CELS) group within ServiceNow so tickets can be assigned to the group 2) Redirect email from help(a)cels.anl.gov<mailto:[email protected]> to point to Argonne(a)service-now.com<mailto:[email protected]> (I need to check with our service desk that they have this ability) 3) Let our two teams know that the group is active and ticket management should begin! Thanks, Jack _________________________ Argonne National Laboratory Jack Schmidt IT Process Manager/Service Manager CIS Service Management 630-252-1533

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 09 Jul '14

09 Jul '14

This is the mail system at host biologin-4.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <bartels(a)mcs.anl.gov>: host mailgw.mcs.anl.gov[140.221.6.6] said: 550 5.1.1 <bartels(a)mcs.anl.gov>: Recipient address rejected: User unknown in relay recipient table (in reply to RCPT TO command)

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 09 Jul '14

09 Jul '14

This is the mail system at host biologin-4.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <arodri7(a)mcs.anl.gov>: host mailgw.mcs.anl.gov[140.221.7.6] said: 550 5.1.1 <arodri7(a)mcs.anl.gov>: Recipient address rejected: User unknown in relay recipient table (in reply to RCPT TO command)

1 0

IPMI and I2U2.
by rackow＠anl.gov 09 Jul '14

09 Jul '14

It appears that with all the new vulns being reported in IPMI, Shadowserver has taken up the task of scanning the world again. It appears they have found an IPMI service running on node1.i2u2.org. Running some netflow, this appears to be from a scan they did at 0705.20:14:11 They poked UDP 192.5.186.80 623 via UDP and get a response back. They probed lots of other systems, but only this 1 responded. "timestamp","ip","port","hostname","tag","ipmi_version","asn","geo","region","city","none_auth","md2_auth","md5_auth","passkey_auth","oem_auth","defaultkg","permessage_auth","userlevel_auth","usernames","nulluser","anon_login","error","deviceid","devicerev","firmwarerev","version","manufacturerid","manufacturername","productid","productname" "2014-07-06 01:14:11","192.5.186.80",623,"node1.i2u2.org","ipmi","1.5",683,"US","ILLINOIS","LEMONT","no","no","no","no","yes","-","disabled","disabled","yes","no","no",,,,,,,,, I'm not exactly sure what they are reporing in this. Any hope of just killing UDP access from outside on these subnets? In looking at the netflow logs for the past week, it appears the only legit traffic is syslog going to 130.202.172.3 Argonne central server. syslog going to 128.135.125.120 con.ci.uchicago.edu. radius traffic going to auth.mcs.anl.gov:1812 dns traffic to 130.202.101.6 and 130.202.101.37 Why is 192.5.186.65:161 talking to 192.117.188.130 random ports? Israeli Traktor Company 0701.05:54:40.571 0701.05:54:40.571 5 192.117.188.130 19922 3 192.5.186.65 161 17 0 2 176 0701.05:54:40.578 0701.05:54:40.578 5 192.5.186.65 161 3 192.117.188.130 19922 17 0 1 134 0701.05:54:40.600 0701.05:54:40.600 6 192.5.186.65 161 3 192.117.188.130 19922 17 0 1 134 0701.06:39:40.532 0701.06:39:40.532 5 192.117.188.130 22913 3 192.5.186.65 161 17 0 2 176 0701.06:39:40.547 0701.06:39:40.547 5 192.5.186.65 161 3 192.117.188.130 22913 17 0 1 134 0701.06:39:40.571 0701.06:39:40.571 6 192.5.186.65 161 3 192.117.188.130 22913 17 0 1 134 0701.07:25:57.035 0701.07:25:57.035 5 192.117.188.130 26045 3 192.5.186.65 161 17 0 2 176 0701.07:25:57.058 0701.07:25:57.058 5 192.5.186.65 161 3 192.117.188.130 26045 17 0 1 134 0701.07:25:57.090 0701.07:25:57.090 6 192.5.186.65 161 3 192.117.188.130 26045 17 0 1 134 They probe, we respond. There are many other probes that are not getting anywhere. The 2 below are the only others that got a response. 0705.09:21:15.302 0705.09:21:15.302 6 71.6.165.200 40000 3 192.5.186.80 5353 17 0 2 148 0705.09:21:15.300 0705.09:21:15.300 6 192.5.186.80 5353 3 71.6.165.200 40000 17 0 2 212 0705.20:14:11.197 0705.20:14:11.197 6 192.5.186.80 623 3 184.105.247.230 53030 17 0 2 116 0705.20:14:11.174 0705.20:14:11.174 5 184.105.247.230 53030 3 192.5.186.80 623 17 0 2 102 --Gene

3 5