March 2015 - Core-other - mailman3.cels.anl.gov

Request AREQ0037271 Watch List completed: Block on globus.org IP Impacting Service
by Argonne Service Desk 31 Mar '15

31 Mar '15

Please do not respond to this message. If you need assistance, please contact the Service Desk. Hello, This request has been completed. If you need further assistance, please contact us. Please note that replying to this message will not reopen the ticket. Number: AREQ0037271 Customer: John Kordas Short Description: Block on globus.org IP Impacting Service Comments: 2015-03-31 11:33 CDT - Eugene RackowCustomer Comments The problem that caused this server to be blocked is that the 54.211.8.201 host at 2015-03-23 10:22:52 attempted to do a GET of /ftppub/myproxy/VERSION with a user-agent string of: () { foo;};echo; /bin/bash -c "expr 299663299665 / 3; echo 333:; uname -a; echo 333:; id;" Basicly testing to see if the server is vulnerable to CVE-2014-6271. This kind of activity will get the IP blocked. If the amazon servers are acting as a proxy, they should be preventing this kind of attack from being relayed through them. 2015-03-31 11:30 CDT - John KordasCustomer Comments reply from: kordas(a)ci.uchicago.edu Hi Matt, We launched the instance on 3/13. Jack On Tue, Mar 31, 2015 at 11:23 AM, Argonne Service Desk < argonne(a)service-now.com> wrote: > > > You can reply directly to this email. Please enter your response above > this line. > ------------------------------ > > > Hello, John Kordas, > > A new comment has been entered on your request. > > If this is a request for additional information, please reply at your > earliest convenience to assist us in fulfilling your request. > > Number: AREQ0037271 (LINK > <https://argonne.service-now.com/self_service/detail.do?sysparm_document_key…> > ) > Short Description: Block on globus.org IP Impacting Service > Comments: > ------------------------------ > *2015-03-31 11:22 CDT - Matthew Harvey*Customer CommentsSo it looks like > the IP 54.211.8.201 was getting blocked because it triggered the "Shell > Shock" Snort rule in our IDS on 3/23/15. > > I will remove the block but I just want to make sure that this is a false > positive before I do so. > > When did you take over this IP? > > -Matt > > > Thank you, > Argonne Service Desk > 630-252-9999, option 2 > help(a)anl.gov > > Ref:MSG0342585 > 2015-03-31 11:22 CDT - Matthew HarveyCustomer Comments So it looks like the IP 54.211.8.201 was getting blocked because it triggered the "Shell Shock" Snort rule in our IDS on 3/23/15. I will remove the block but I just want to make sure that this is a false positive before I do so. When did you take over this IP? -Matt Thank you, Argonne Service Desk 630-252-9999, option 2 help(a)anl.gov Ref:MSG0342604

1 0

[CELS Sysadmins] Security Meeting
by Craig Stacey 31 Mar '15

31 Mar '15

Reminder that on Wednesday we're scheduled to have the group security meeting. This meeting should go ahead whether I'm available or not. Take some time now to look over your items in scavenger: https://webapps.inside.anl.gov/scavenger/index.php Knock out what you can now. At the meeting on Wednesday, plow through the remaining items and let's get the count of open items as low as we can. Thanks!

2 1

[CELS Sysadmins] where's Linda 3/27
by Linda Winkler 27 Mar '15

27 Mar '15

Working downtown today on MREN gear lw

1 0

[CELS Sysadmins] Power work in the data center scheduled for April 20.
by Stacey, Craig J. 26 Mar '15

26 Mar '15

Right now it's looking like April 20th is when they're going to be performing some power work in the data center. Expect an announcement from Fred soon, once the scope of work is finalized, but here's the reader's digest version: * They'll be switching everything that's on the "B" power feed over to the "A" power feed. This is not a bumpless switch, there will be a blip on the order of milliseconds. This blip will affect every PDU in the room on the B feed. This includes all the UPS PDUs, though I don't at the moment have a list of which other PDUs it includes. In any case, though, the circuits on the UPS PDUs will ride out the blip just fine. Anything that's on utility power drawn from the B feed will feel the blip. If the equipment is dual-fed from UPS and Utility, it should be fine. If the equipment is fed solely from utility, or dual-fed but one of the feeds is from the A feed, it should also be fine. I'm reasonably sure Beagle's 408V feed will be affected, however, and I recommend a shutdown be scheduled. Mira will be shutting down, I believe. * Once we are on the "A" feed only, they will then throw the UPS into bypass mode, which means the UPS circuits will remain up, but will *not* be battery-backed. This will be a bumpless switch. * The work is expected to last the day, and at the end of the work, they will again switch the affected PDUs back from the A feed to the B feed. By this point, the UPS work will be complete, and the same situation as in the first bullet applies here. UPS circuits will ride out the bump, utility circuits will not. A more detailed description of the work will follow through official data center management channels, but I wanted to make sure everyone here had as much notice as possible to plan accordingly. -- Craig

1 0

CIS/CELS Service Now (SNOW)
by Stanton-Piersanti, Tina Joy 25 Mar '15

25 Mar '15

When: Thursday, April 09, 2015 3:00 PM-3:30 PM. (UTC-06:00) Central Time (US & Canada) Where: 240-2172 *~*~*~*~*~*~*~*~*~* CIS has suggested that if anyone that has any SNOW questions, concerns or something they would like to see in the future to come to our monthly meeting.

1 0

CIS/CELS Service Now (SNOW)
by Stanton-Piersanti, Tina Joy 25 Mar '15

25 Mar '15

When: Thursday, April 09, 2015 4:00 PM-4:30 PM. (UTC-06:00) Central Time (US & Canada) Where: 240-2172 *~*~*~*~*~*~*~*~*~* CIS has suggested that if anyone that has any SNOW questions, concerns or something they would like to see in the future to come to our monthly meeting.

1 0

[CELS Sysadmins] Where's Craig (slight schedule change)
by Stacey, Craig J. 24 Mar '15

24 Mar '15

As mentioned previously, I'm taking this Friday as a vacation day. Normally the following Friday (April 3) would be my every other Friday off, but due to a bunch of people being out, plus my need to take the following Friday off, I'm shifting things around. It's up to date on the calendar, but the short story is: This week: Mon-Thu, normal. Fri, vacation March 30-April 3: In all week April 6-April 9: normal, Fri April 10: compressed schedule day off April 13-16: Normal, Fri April 17: compressed schedule day off Then back to normal 5 day 4 day schedule. Clear as mud. -- Craig

1 0

[CELS Sysadmins] New Userbase Updates
by Leggett, Torrance I. 24 Mar '15

24 Mar '15

I just updated the code base on the new staging environments. This update included a pretty substantial memory leak fix that should be tested out. I'd appreciate people testing out things to make sure they still work as expected. Here are the new URLs for the staging environment: https://sovereign-stage.cels.anl.gov https://accounts-stage.mcs.anl.gov https://accounts-stage.ci.anl.gov https://accounts-stage.jlse.anl.gov https://accounts-stage.lcrc.anl.gov

1 0

Fw: Where's JohnR?
by Roberts, John E. 23 Mar '15

23 Mar '15

Another sick day tomorrow please. Can't catch a break yet. --- John Roberts Sent from My Mobile Device From: "Roberts, John E." <jeroberts(a)anl.gov> Sent: Mar 22, 2015 10:04 PM To: core-admins Subject: Where's JohnR? Dealing with the flu since Friday. I don't expect to be in tomorrow. --- John Roberts Sent from My Mobile Device

1 0

[CELS Sysadmins] FW: Riggers delivering pallets to offices
by Stacey, Craig J. 23 Mar '15

23 Mar '15

When ordering anything that's bound for the data center, make sure you specify that fact in the mail so Kathy D knows to put that information in the req. Thanks! -- Craig ________________________________ From: Stacey, Craig J. Sent: Monday, March 23, 2015 3:00 PM To: Stickels Cc: Stickels, Judith K. Subject: RE: Riggers delivering pallets to offices This was delivered to Dan. We moved it to the DC. I'll make sure everyone specifies to purchasing when something is bound for the DC. Thanks. -- Craig ________________________________ From: Stickels [stickels(a)mcs.anl.gov] Sent: Monday, March 23, 2015 2:51 PM To: Stacey, Craig J. Cc: Stickels, Judith K.; Stickels, Judith K. Subject: Re: Riggers delivering pallets to offices Hi Craig, Whose package was it and when was it delivered? There's a box on the purchase req for a room # to be inserted. It autofills with recipient info, but it can be changed to another destination without a problem. Do you need me to get someone to move it? --Judy On Mar 23, 2015, at 2:26 PM, "Stacey, Craig J." <stace(a)anl.gov<mailto:[email protected]>> wrote: See this: https://www.dropbox.com/sc/vxt04ryng5petm7/AADt6r9blyPsJjPTYKEJSDiVa We need some way to make sure this doesn't happen. For one, that's not a safe place to leave a pallet full of equipment. We're lucky Gary doesn't walk along that hallway. Is there some way we can make them aware not to deliver pallets to offices? I can think of no situation where that would be desirable. These should go to the data center or the loading dock. Never left in a hallway or brought into an office. If they're taking a pallet jack down to an office, something has gone wrong. Is there a way we can specify when making an order that something is destined for the data center so they can be aware of that when it's time to come drop it off? -- Craig Judy Stickels Manager, TCS Building Operations MCS/240, Rm. 3156 Argonne National Laboratory 9700 South Cass Avenue Argonne, IL 60439 630-252-3369 (voice) stickels(a)mcs.anl.gov<mailto:[email protected]>

1 0