December 2010 - Core-students - mailman3.cels.anl.gov

Where's Chris?
by Chris Walker 14 Dec '10

14 Dec '10

Tomorrow (Wednesday) I need to have the young hockey player in Naperville at 5:50 for an early game, so to make that happen, I'm gonna work from home.. Should be an excellent day to userbase! (Yes, it has become a verb..) Should have some cool things to show off Thursday

1 0

I have to run out for a few..
by Tina Stanton-Piersanti 14 Dec '10

14 Dec '10

I need to go pick up something for Nikki (my sick child). Be back shortly. T.

1 0

Where's Dan?
by Dan Olson 14 Dec '10

14 Dec '10

I'm taking a late lunch today, I should be back by 2:30 or so. ---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055

1 0

INFO: Zimbra Slow for some users..., Ticket No. 35484, Status=Pending
by Argonne Service Desk 14 Dec '10

14 Dec '10

When replying, type your text above this line. ---------------------------------------------- Notification of Incident Change If the pending code above shows “Waiting on Customer”, followup action is required on your part as requested in the Description text below. Incident: Zimbra Slow for some users... Incident Number: 35484 Priority: Medium Status: Pending Date: 2010-12-14 Time: 10:22:55 Creation Date: 2010-12-06 Creation Time: 09:30:10 Created By: tstanton(a)mcs.anl.gov View Incident in Browser: https://tickets.anl.gov/MRcgi/MRlogin.pl?DL=35484DA12 Detail: Entered on 2010-12-14 at 10:22:55 CST (GMT-0600) by Michael Rios: Tina, is there still a speed issue at this point? Thanks! mike r. . Entered on 2010-12-06 at 13:36:14 CST (GMT-0600) by Michael Rios: tina. I don't believe this is an issue with Zimbra. None of memory, CPU, or load average on the Zimbra server show any deviation from the norm or present as being stressed. Nothing in the Zimbra logs indicate a service slowdown or overloading. There are, to my knowledge, still issues related specifically to MCS users and the networking between us. No other users but MCS users have come to our help desk with Zimbra issues (or slowness/connectivity issues related to other services we provide). I will leave this ticket open and continue to monitor the state of Zimbra. So far there is nothing here to raise an alarm that isn't, in my opinion, related to other issues being tracked down right now. Short-term, if there is something critical that you need to do with Craig's calendar, call me at x2-RIOS and we'll work something out. Thanks! mike r. . Entered on 2010-12-06 at 13:09:10 CST (GMT-0600) by tstanton(a)mcs.anl.gov: Hi Mike, RIght now I am trying to get an entry on Craig Stacey's calendar and I am getting the following message: The server appears to be slow to respond, and may be unavailable. Press the button to cancel your request". I am assuming that this would be a CIS issue and not MCS? Please advise. Thanks! Tina On Dec 6, 2010, at 10:34 AM, Argonne Service Desk wrote: [Duplicate message snipped] Entered on 2010-12-06 at 10:34:15 CST (GMT-0600) by Michael Rios: Thanks Tina! I just ran Zimbra via web and IMAP client (Thunderbird) and found no user-impacting issue. The logs don't indicate anything broken, though there were some very active users just after 9am (and a corresponding small uptick in load average). This might be what was seen. I'm going to close this, but keep an eye on Zimbra today just in case this is the tip of some hidden iceberg. Entered on 2010-12-06 at 09:41:21 CST (GMT-0600) by Elsie Mackey: assign ticket to zimbra team Entered on 2010-12-06 at 09:30:09 CST (GMT-0600) by tstanton(a)mcs.anl.gov: I have received several calls re: mail being slow and not loading so they can print . So far my Zimbra seems fine. Just passing on what my users are complaining to us about. Thanks! Tina Current Assignees: Zimbra CC(s): (permanent) tstanton(a)mcs.anl.gov, core-admins(a)mcs.anl.gov, emackey(a)anl.gov Customer Information: Last Name: Stanton-Piersanti First Name: Tina Email Address: tstanton(a)mcs.anl.gov Badge: 46576 Login ID: tstanton ANL Division: MCS Costcenter: 145 Building: 240 Room: 2136 Phone: (630) 252-6536 This is an automated message sent by the Numara FootPrints ticket tracking system, which is operated by CIS.

2 1

Fwd: Friendly Christmas Advice
by Tina Stanton-Piersanti 14 Dec '10

14 Dec '10

This advice to our group is so fitting... T. > > Friendly Christmas Advice > > Please, take care of yourself this Christmas. A recent joint study > conducted by the Department of Health and the Department of Motor > Vehicles indicates that 23% of traffic accidents are alcohol related. > This means that the remaining 77% are caused by assholes that just > drink coffee, carbonated drinks, juices, milk, water, and shit like > that. > Therefore, beware of those who do not drink alcohol. They cause three > times as many accidents. > This message is sent by someone who cares about your well being.

1 0

Where's Tina
by Tina Stanton-Piersanti 14 Dec '10

14 Dec '10

Nicolette is sick w/ what I think is the flu. I am going to work from home today so she has someone here w/ her if she gets worse. I'll be available the usual ways. Cell # is 815-931-9694. T.

1 0

Re: Tuesday
by Corby Schmitz 13 Dec '10

13 Dec '10

I'll be in long before 8. Corby Schmitz Sent from my mobile office On Dec 13, 2010, at 21:09, Craig Stacey <stace(a)mcs.anl.gov> wrote: > Hey, I went looking for you before I left but everyone was gone. > > I don't think I can be there at 8, but I'm copying the group so someone can show you if you can't figure it out from the drawing. It's the orange machine in the upper left side of the drawing. > > <core-latest-rotated.pdf>

1 0

Re: Tuesday
by Craig Stacey 13 Dec '10

13 Dec '10

Hey, I went looking for you before I left but everyone was gone. I don't think I can be there at 8, but I'm copying the group so someone can show you if you can't figure it out from the drawing. It's the orange machine in the upper left side of the drawing. On Dec 13, 2010, at 7:14 PM, Amiot, Lawrence W. wrote: > I assume you will be around tomorrow morning at 8:00 to show us the exact spot to set the cluster. > > Larry Amiot > Transportation Research and Analysis Computing Center > W 630 578 4259 > C 312 342 4281 > Amiot(a)anl.gov == Craig

1 0

[CELS Sysadmins] Preventing root login attempts via crytocard
by Zbiegiel, Piotr T. 13 Dec '10

13 Dec '10

Over the past few weeks it has become clear that SSH brute force attacks are impacting the operation of the cryptocard servers. ALCF operations staff has been reporting intermittent problems logging into resources. Some of these incidents seem to correlate with periods of distributed SSH brute-force attacks against the lab. Most of these attacks target the user root. We decided to look into improving the situation by seeing if we could limit the number of root login attempts from ALCF systems and we'd like to pass along the information to other teams who use cryptocard. In the case of ALCF we cannot disable root logins on our externally accessible systems because we use the account to manage the systems internally. In our environment authentication for root is completed via a key-based authentication and root should never authenticate via cryptocard. This means that we needed to allow root to authenticate via keys but disable root's ability to authenticate via PAM (which facilitates cryptocard logins using the radius module). There are many ways to approach this problem but we wanted to share a couple solutions we've tested to encourage others who have externally accessible systems to consider preventing root login attempts from sending traffic to the cryptocard server and improving performance and stability (not to mention security) for everyone. 1) SSHD "match" option Newer versions of OpenSSH have a feature that allows conditional configuration options for the server. The version of OpenSSH installed on our systems would need to be upgraded to use this option. match user root KbdInteractiveAuthentication no Including the lines above at the end of the sshd_config would disallow PAM authentication for the root user only. This would prevent external users attempting to log in as root from even receiving the password prompt. match works with other criteria as well such as Host or Address. Address can accept cidr notation so you can disable root logins for all except internal systems. See the sshd_config man page for more info. 2) PAM module pam_listfile.so PAM includes a module that can allow or deny access to a list of users (among other criteria). You can add the module to the sshd authentication stack before PAM attempts radius and prevent the user root from ever being prompted for a password. auth requisite pam_listfile.so onerr=succeed item=user sense=deny file=/etc/ssh/ssh.denyusers The line above would be placed in the /etc/pam.d/sshd file before sshd attempts radius/cryptocard authentication. The "requisite" keyword causes PAM to immediately fail the login attempt as soon as this test fails. "required" still calls the other modules in the auth stack. The file "/etc/ssh/ssh.denyusers" can be named anything and contains the single entry "root". Again, the hostbased and key authentication is unencumbered for internal connections but external users attempting to login as root are not even presented with a password prompt. *Another interesting PAM module is pam_localuser.so which requires that the user be listed in the local /etc/passwd file before allowing PAM authentication to continue. Used with the requisite keyword would cut off the random account name guessing attacks as well. This assumes, of course, that all users on the system exist in /etc/passwd. The module probably won't work if LDAP is being used to user management. ALCF has tested and implemented a solution. The cryptocard server (at MCS) should be seeing practically no attempted root logins from ALCF systems at this time. If you'd like to try this on your systems please don't hesistate to contact me if you have any questions. Thanks! -- Piotr T Zbiegiel Cyber Security Engineer Argonne National Laboratory _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

Where's Max?
by Max trefonides 13 Dec '10

13 Dec '10

Running a tad late, I'll be in before 10 -max

1 0