Around 4:45am this morning we had several user accounts attempt to sudo on multiple mcs machines. We are still investigating the root cause. Please check for anything unusual on the machines you manage. ---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055
What users and do we know where from? Do we need to get flows from Gene yet? On Oct 13, 2011, at 10:00 AM, Dan Olson wrote:
Around 4:45am this morning we had several user accounts attempt to sudo on multiple mcs machines. We are still investigating the root cause. Please check for anything unusual on the machines you manage.
---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055
update turam's account from login.ci to login*.mcs then from login.mcs to the am-mac machines. Ken & Eric Olson's account were also used during this timeframe, both users who would have entered their passwords on the am-mac machines. ---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055 ----- Original Message ----- From: "Ti Leggett" <[email protected]> To: "Dan Olson" <[email protected]> Cc: "Core Admins" <[email protected]> Sent: Thursday, October 13, 2011 10:03:53 AM Subject: Re: possible hack attack What users and do we know where from? Do we need to get flows from Gene yet? On Oct 13, 2011, at 10:00 AM, Dan Olson wrote:
Around 4:45am this morning we had several user accounts attempt to sudo on multiple mcs machines. We are still investigating the root cause. Please check for anything unusual on the machines you manage.
---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055
Just FYI, I changed my MCS password just now after finding this out. Ken Raffenetti Systems Administration Associate MCS Division - Argonne National Laboratory On 10/13/2011 10:45 AM, Dan Olson wrote:
update
turam's account from login.ci to login*.mcs then from login.mcs to the am-mac machines. Ken & Eric Olson's account were also used during this timeframe, both users who would have entered their passwords on the am-mac machines.
---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055
----- Original Message ----- From: "Ti Leggett" <[email protected]> To: "Dan Olson" <[email protected]> Cc: "Core Admins" <[email protected]> Sent: Thursday, October 13, 2011 10:03:53 AM Subject: Re: possible hack attack
What users and do we know where from? Do we need to get flows from Gene yet?
On Oct 13, 2011, at 10:00 AM, Dan Olson wrote:
Around 4:45am this morning we had several user accounts attempt to sudo on multiple mcs machines. We are still investigating the root cause. Please check for anything unusual on the machines you manage.
---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055
I've notified Piotr in ALCF that Tom's account is almost assuredly compromised as may be Eric's. On Oct 13, 2011, at 10:47 AM, Ken Raffenetti wrote:
Just FYI, I changed my MCS password just now after finding this out.
Ken Raffenetti Systems Administration Associate MCS Division - Argonne National Laboratory
On 10/13/2011 10:45 AM, Dan Olson wrote:
update
turam's account from login.ci to login*.mcs then from login.mcs to the am-mac machines. Ken & Eric Olson's account were also used during this timeframe, both users who would have entered their passwords on the am-mac machines.
---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055
----- Original Message ----- From: "Ti Leggett" <[email protected]> To: "Dan Olson" <[email protected]> Cc: "Core Admins" <[email protected]> Sent: Thursday, October 13, 2011 10:03:53 AM Subject: Re: possible hack attack
What users and do we know where from? Do we need to get flows from Gene yet?
On Oct 13, 2011, at 10:00 AM, Dan Olson wrote:
Around 4:45am this morning we had several user accounts attempt to sudo on multiple mcs machines. We are still investigating the root cause. Please check for anything unusual on the machines you manage.
---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055
participants (3)
-
Dan Olson -
Ken Raffenetti -
Ti Leggett