December 2008 - Core-students - mailman3.cels.anl.gov

SSH brute force attack from medem.uchicago.edu
by rackow＠anl.gov 28 Dec '08

28 Dec '08

ec 27, 2008 between 00:46:43 and 00:46:51 medem.uchicago.edu was used as part of a SSH brute force attack against a number of machines at ANL in the 140.221.x.y IP address range. The attempts from your host for for a non-existant user quenby on our systems. This attack was part of a much bigger attack set, and probably bot driven. Other machines attempted other user names. You probably want to check that machine for some bot infection. --Gene /~\ The ASCII Gene Rackow email: rackow(a)anl.gov \ / Ribbon Campaign Cyber Security Office voice: 630-252-7126 X Against HTML Argonne National Lab / \ Email! 9700 S. Cass Ave. / Argonne, IL 60439

2 1

Output from "cron" command
by Super-User 28 Dec '08

28 Dec '08

Your "cron" job on mercury /usr/lib/fs/nfs/nfsfind produced the following output: find: stat() error /exports/mcs-homes109/jazokas/rsync_csi336496_sb/VTK-PV/VTK/Utilities/vtkfreetype/src/gzip: Value too large for defined data type find: stat() error /exports/mcs-homes15/volkart/Documents/attachments_2008_05_29/image001.jpg: Value too large for defined data type find: stat() error /exports/mcs-homes15/volkart/Documents/attachments_2008_05_29/CCI Program Syllabus summer 2008.pdf: Value too large for defined data type find: stat() error /exports/mcs-homes15/dtaylor/Pictures/Plants/Peony.jpg: Value too large for defined data type find: stat() error /exports/mcs-homes15/dtaylor/Pictures/Plants/Purple Frond.jpg: Value too large for defined data type find: stat() error /exports/mcs-homes15/dtaylor/Pictures/Plants/Maple.jpg: Value too large for defined data type find: stat() error /exports/mcs-homes15/dtaylor/Pictures/Plants/Dandelion Seeds.jpg: Value too large for defined data type find: stat() error /exports/mcs-homes15/dtaylor/Pictures/Plants/Agave.jpg: Value too large for defined data type find: stat() error /exports/mcs-homes15/dtaylor/Pictures/Plants/Daisies.jpg: Value too large for defined data type find: stat() error /exports/mcs-homes15/dtaylor/Pictures/Plants/Petals.jpg: Value too large for defined data type find: stat() error /exports/mcs-homes15/dtaylor/Pictures/Plants/.DS_Store: Value too large for defined data type find: stat() error /exports/mcs-homes15/dtaylor/Pictures/Plants/Dandelion.jpg: Value too large for defined data type find: stat() error /exports/mcs-homes15/dtaylor/Pictures/Plants/Lotus.jpg: Value too large for defined data type find: stat() error /exports/mcs-homes64/vijaysm/.mozilla/firefox/byfrvktb.default/extensions/bettergmail2(a)ginatrapani.org/install.rdf: Value too large for defined data type find: stat() error /exports/mcs-homes64/vijaysm/.mozilla/firefox/byfrvktb.default/extensions/bettergmail2(a)ginatrapani.org/chrome.manifest: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc/00000001.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc/00000002.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc/My Music/00000002.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc/My Music/00000001.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc/My Pictures/RR/DMIR_6/DMIR222a.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc/My Pictures/RR/DMIR_6/DMIR222b.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/00000001.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/nek5n/doc/movies: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/My Music/00000002.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/My Music/00000001.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/My Pictures/RR/DMIR_6/DMIR222b.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/My Pictures/RR/DMIR_6/DMIR222a.JPG: Value too large for defined data type find: stat() error /exports/proj-fischer00/fischer/pc2/00000002.JPG: Value too large for defined data type

1 0

RE: Something wrong with Cryptocard.
by Rick Bradshaw 28 Dec '08

28 Dec '08

Fixed. I also took the opportunity to boot the latest kernel. Rick -----Original Message----- From: Rick Bradshaw <bradshaw(a)mcs.anl.gov> Sent: Sunday, December 28, 2008 9:36 AM To: admins / MCS <admins(a)mcs.anl.gov> Subject: Something wrong with Cryptocard. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am heading in to figure out what is wrong. I will report once I find the issue. Rick -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJV5zmdavihOKkCCERAqZ5AKCmJ10qYkG7iLGrn+5IswwR/FEEwACdEJHi Cokc+LNL4Zpebd35IMXje34= =yx6d -----END PGP SIGNATURE-----

1 0

Something wrong with Cryptocard.
by Rick Bradshaw 28 Dec '08

28 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am heading in to figure out what is wrong. I will report once I find the issue. Rick -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJV5zmdavihOKkCCERAqZ5AKCmJ10qYkG7iLGrn+5IswwR/FEEwACdEJHi Cokc+LNL4Zpebd35IMXje34= =yx6d -----END PGP SIGNATURE-----

1 0

failure notice
by MAILER-DAEMON＠hol.gr 27 Dec '08

27 Dec '08

Hi. This is the qmail-send program at hol.gr. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. -------------------- Postmaster postmaster(a)hol.gr Hellas On Line SA <oikonomia(a)hol.gr>: The users mailfolder is over the allowed quota (size). (#5.2.2) --- Below this line is a copy of the message. Return-Path: <www-data(a)mcs.anl.gov> Received: (qmail 30571 invoked from network); 27 Dec 2008 17:04:29 -0000 Received: from unknown (HELO mx12.hol.gr) ([192.168.20.57]) (envelope-sender <www-data(a)mcs.anl.gov>) by maildir1.mail.dc.hol.net (qmail-ldap-1.03) with SMTP for <oikonomia(a)hol.gr>; 27 Dec 2008 17:04:29 -0000 Received: from owney.mcs.anl.gov (owney.mcs.anl.gov [140.221.9.71]) by mx12.hol.gr (Postfix) with ESMTP id 1088A19336F for <oikonomia(a)hol.gr>; Sat, 27 Dec 2008 19:04:21 +0200 (EET) Received: by owney.mcs.anl.gov (Postfix, from userid 33) id 9311A8F3E1; Sat, 27 Dec 2008 11:04:17 -0600 (CST) Subject: =?UTF-8?B?W21jcy1zeXN0ZW1zICMyMzY2N10gQXV0b1JlcGx5OiAiIMOOwqTDj8KBw47C?= =?UTF-8?B?rMOPwoDDjsK1w47CtsOOwrXDj8KCIDogw4LCq8OOwojDjsK6w47CscOPwojD?= =?UTF-8?B?jsKxw47CvcOCwrsgMSwxMTYgw47CtMOOwrnDj8KCLiDDj8KDw47CtSDDjsKt?= =?UTF-8?B?w47CvcOOwrEgw47CvMOOwq7DjsK9w47CsSEgIg==?= From: "MCS Systems via RT" <systems(a)mcs.anl.gov> Reply-To: systems(a)mcs.anl.gov In-Reply-To: <a7fb516f541ea04e8dfa560f873213a2(a)hol.gr> References: <RT-Ticket-23667(a)mcs.anl.gov> <a7fb516f541ea04e8dfa560f873213a2(a)hol.gr> Message-ID: <rt-3.6.1-6465-1230397457-1092.23667-33-0(a)mcs.anl.gov> Precedence: bulk X-RT-Loop-Prevention: mcs-rt RT-Ticket: mcs-rt #23667 Managed-by: RT 3.6.1 (http://www.bestpractical.com/rt/) RT-Originator: oikonomia(a)hol.gr To: oikonomia(a)hol.gr MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit X-RT-Original-Encoding: utf-8 Date: Sat, 27 Dec 2008 11:04:17 -0600 X-RT-From: "MCS Systems via RT" <systems(a)mcs.anl.gov> X-RT-To: oikonomia(a)hol.gr X-RT-Cc: X-RT-Reply-To: systems(a)mcs.anl.gov X--MailScanner-Information: Please contact the ISP for more information X--MailScanner-ID: 1088A19336F.71D71 X--MailScanner: Found to be clean X--MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-2.399, required 6, ANY_BOUNCE_MESSAGE 0.10, BAYES_00 -2.60, VBOUNCE_MESSAGE 0.10) X--MailScanner-From: www-data(a)mcs.anl.gov X-Spam-Status: No ==Updated 10/15/2008== Hello, Please read the entire message. We have a number of quick tips at the bottom of this message that may just answer your question and get you up and running sooner. This message has been automatically generated in response to the creation of a trouble ticket regarding: "" Τράπεζες : «Έκαψαν» 1,116 δις. σε ένα μήνα! "", a summary of which appears below. There is no need to reply to this message right now. Your ticket has been assigned an ID of [mcs-systems #23667]. Please include the string: [mcs-systems #23667] in the subject line of all future correspondence about this issue. To do so, you may reply to this message. This e-mail address is for reporting problems in the MCS core computing infrastructure. If your request is not related to that, we'll make sure it reaches the right people. However, for future reference, please make note of the addresses below to ensure a faster response: Jazz: systems(a)lcrc.anl.gov BlueGene or ALCF: support(a)alcf.anl.gov Full Disclosure (fd.mcs.anl.gov) fd-support(a)mcs.anl.gov Cosmea: support(a)cosmea.mcs.anl.gov kbT: support(a)kbt.mcs.anl.gov ==Common Issues== "My account has been disabled." If your account has been disabled, you must contact the help desk either in person in room B256 of building 221, or call 630-252-6813 between 8:30AM and 11:30AM or 12:30PM and 5:00PM Monday through Friday to have it reactivated. "I need an IP address for my computer." http://www-unix.mcs.anl.gov/computing/info/faq/netaccess/ "How do I access MCS computers from offsite?" http://www.mcs.anl.gov/faq/SSH_keys "How do I forward/stop forwarding my mail?" http://www.mcs.anl.gov/faq/Mail#Forwarding_mail "How do I set an out of office or vacation message?" http://www.mcs.anl.gov/faq/Mail#Set_an_Out_of_Office_Message "How do I change my password, update my SSH key, or renew a sponsored account?" https://accounts.mcs.anl.gov/account.php "How do I add myself to a unix group, or add someone to a unix group I control?" https://accounts.mcs.anl.gov/unixgroups.php Other helpful URLS: http://www.mcs.anl.gov/faq http://www.mcs.anl.gov/faq/Mail http://www.mcs.anl.gov/windows http://www.mcs.anl.gov/macos https://accounts.mcs.anl.gov Thank you, MCS Systems systems(a)mcs.anl.gov ------------------------------------------------------------------------- www.sofokleous10.gr Τράπεζες : «Έκαψαν» 1,116 δις. σε ένα μήνα! Διαψεύδονται οι μύθοι περί «ισχυρών ελληνικών τραπεζών», με «αντοχή στις πιέσεις της συγκυρίας», από τα επίσημα στοιχεία που έδωσε χθες η Τράπεζα της Ελλάδος στη δημοσιότητα: αμέσως μόλις η διεθνής κρίση «έδειξε δόντια», οι ελληνικές τράπεζες είδαν να «καίγονται» 1,116 δις. ευρώ από τα ίδια κεφάλαιά τους! Το τελευταίο Στατιστικό Δελτίο της ΤτΕ, που καλύπτει τη χρονική περίοδο μέχρι και το τέλος Οκτωβρίου 2008, είναι ιδιαίτερα αποκαλυπτικό για την πραγματική κατάσταση του τραπεζικού συστήματος, που μέχρι πριν από λίγους μήνες περιγραφόταν � �πό τραπεζίτες και κυβερνητικούς παράγοντες ως δήθεν ισχ... Περισσότερα... WALL St :Είναι το φάρμακο χειρότερο από την ασθένεια; H εμπιστοσύνη του παγκόσμιου κοινού εξαντλήθηκε το 2008.Αλλά δεν υπάρχει έλλειψη ρευστού, καθώς η Fed τυπώνει χρήμα σαν παλαβή. Είναι μία λάθος προσέγγιση που ίσως έχει μοιραίες συνέπειες,λέει ο Τζέημς Γκραντς.Είναι μία παρηγοριά για τους Αμερικανούς σε... ΔΙΑΒΑΣΤΕ ΑΚΟΜΑ: Πούτιν: Τελειώνει η εποχή του φθηνού αερίου Σε κρίση οι οικονομίες της Νέας Ευρώπης το 2009 Η ισπανική οικονομία σε ύφεση Ενδιαφέρον από επτά επενδυτές για το πτητικό έργο της Ολυμπιακής Στο άρθρο 99 και ο Μεσοχωρίτης Αίτηση πτώχευσης κατέθεσε η Teledome Σε ιστορικά χαμηλά ο δείκτης οικονομικού κλίματος Τέλος οι κατασχέσεις εως 1000 Ε Υπερψηφίστηκε ο προϋπολογισμός του 2009 Helios : Το πρώτο κατηγορητήριο Κόντρα ΝΔ - ΠΑΣΟΚ για τους πυροβολισμούς στην κλούβα των ΜΑΤ Unsubscribe

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 27 Dec '08

27 Dec '08

This is the Postfix program at host owney.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program <123abcxxx(a)yahoo.com>: host e.mx.mail.yahoo.com[216.39.53.1] said: 554 delivery error: dd This user doesn't have a yahoo.com account (123abcxxx(a)yahoo.com) [0] - mta383.mail.re4.yahoo.com (in reply to end of DATA command)

1 0

Re: Mail-log File
by Jorge More 26 Dec '08

26 Dec '08

Argonne is closed from December 23 until January 5. I will try to answer all email as soon as possible after that.

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 24 Dec '08

24 Dec '08

This is the Postfix program at host owney.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program <postales(a)terravirtual.com>: Host or domain name not found. Name service error for name=terravirtual.com type=AAAA: Host found but no data record of requested type

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 24 Dec '08

24 Dec '08

This is the Postfix program at host owney.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program <OriginalEcoCanteen(a)continentulin.com>: host ns.continentulin.com[74.208.152.253] said: 530 Authentication Required (in reply to RCPT TO command)

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 24 Dec '08

24 Dec '08

This is the Postfix program at host owney.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program <rhtymatics.info(a)rhtymatics.info>: host ns2.rhtymatics.info[208.84.102.187] said: 550 sorry, no mailbox here by that name (in reply to RCPT TO command)

1 0