Please do not respond to this message. If you need assistance, please contact the Service Desk. Hello, This request has been completed. If you need further assistance, please contact us. Please note that replying to this message will not reopen the ticket. Number: AREQ0037271 Customer: John Kordas Short Description: Block on globus.org IP Impacting Service Comments: 2015-03-31 11:33 CDT - Eugene RackowCustomer Comments The problem that caused this server to be blocked is that the 54.211.8.201 host at 2015-03-23 10:22:52 attempted to do a GET of /ftppub/myproxy/VERSION with a user-agent string of: () { foo;};echo; /bin/bash -c "expr 299663299665 / 3; echo 333:; uname -a; echo 333:; id;" Basicly testing to see if the server is vulnerable to CVE-2014-6271. This kind of activity will get the IP blocked. If the amazon servers are acting as a proxy, they should be preventing this kind of attack from being relayed through them. 2015-03-31 11:30 CDT - John KordasCustomer Comments reply from: [email protected] Hi Matt, We launched the instance on 3/13. Jack On Tue, Mar 31, 2015 at 11:23 AM, Argonne Service Desk < [email protected]> wrote:

You can reply directly to this email. Please enter your response above this line. ------------------------------

Hello, John Kordas,

A new comment has been entered on your request.

If this is a request for additional information, please reply at your earliest convenience to assist us in fulfilling your request.

Number: AREQ0037271 (LINK <https://argonne.service-now.com/self_service/detail.do?sysparm_document_key=u_ad_hoc_request,8b5f65476f47750096d6fbbf1e3ee4b9> ) Short Description: Block on globus.org IP Impacting Service Comments: ------------------------------ *2015-03-31 11:22 CDT - Matthew Harvey*Customer CommentsSo it looks like the IP 54.211.8.201 was getting blocked because it triggered the "Shell Shock" Snort rule in our IDS on 3/23/15.

I will remove the block but I just want to make sure that this is a false positive before I do so.

When did you take over this IP?

-Matt

Thank you, Argonne Service Desk 630-252-9999, option 2 [email protected]

Ref:MSG0342585

2015-03-31 11:22 CDT - Matthew HarveyCustomer Comments So it looks like the IP 54.211.8.201 was getting blocked because it triggered the "Shell Shock" Snort rule in our IDS on 3/23/15. I will remove the block but I just want to make sure that this is a false positive before I do so. When did you take over this IP? -Matt Thank you, Argonne Service Desk 630-252-9999, option 2 [email protected] Ref:MSG0342604