March 2011 - Core-students - mailman3.cels.anl.gov

systems net acls
by Dan Olson 18 Mar '11

18 Mar '11

I looked through the systems net acls, and came across a few questionable ones - Please review and let me know if these are in use. This IP points at a switch permit tcp any host 140.221.13.65 eq 1720 !ARG#43378 ! permit udp any host 140.221.13.65 eq 1719 !ARG#43378 ! permit tcp any host 140.221.13.65 range 5500 5600 !ARG#43378 ! permit udp any host 140.221.13.65 range 2300 2500 !ARG#43378 ! This host is ALSO in the scanner log #temporary rules for ps.mcs.anl.gov permit tcp any host 140.221.8.252 eq 80 permit tcp any host 140.221.8.252 eq 443 This ip is not in dns permit tcp any host 140.221.8.99 eq 80 !ARG#11329 ! permit tcp any host 140.221.8.99 eq 443 !ARG#11329 ! Maybe we can delete these? #temporary rules for SC09 to elephant permit tcp host 192.12.137.4 host 140.221.8.19 range 50000 50100 permit tcp host 192.12.137.5 host 140.221.8.19 range 50000 50100 permit tcp host 192.12.137.129 host 140.221.8.19 range 50000 50100 permit tcp host 128.55.80.35 host 140.221.8.19 range 50000 50100 permit tcp host 128.55.80.36 host 140.221.8.19 range 50000 50100 permit tcp host 140.221.83.11 host 140.221.8.19 range 50000 50100 permit tcp host 140.221.83.12 host 140.221.8.19 range 50000 50100 These are all behind the LWFW with other conduits #Lists for all MCS owned list servers on single lists server with vhosts permit tcp any host 140.221.8.38 eq 80 !ARG#8202 !! !lists.accessgrid.org permit tcp any host 140.221.8.39 eq 80 !ARG#8203 !! !lists.cosmea.mcs.anl.gov # permit tcp any host 140.221.8.40 eq 80 !ARG#8204 !! !lists.bgl.mcs.anl.gov permit tcp any host 140.221.8.41 eq 80 !ARG#8205 !! !lists.cogkit.org permit tcp any host 140.221.8.120 eq 80 !ARG#38877 !! !workshops.alcf.anl.gov permit tcp any host 140.221.8.116 eq 80 !ARG#38266 !! scienceclouds.org permit tcp any host 140.221.8.45 eq 80 !ARG#8207 !! !lists.i2u2.org permit tcp any host 140.221.8.46 eq 80 !ARG#8208 !! !lists.kbt.mcs.anl.gov permit tcp any host 140.221.8.48 eq 80 !ARG#8209 !! !lists.nmpdr.org permit tcp any host 140.221.8.49 eq 80 !ARG#8210 !! !lists.ogce.org permit tcp any host 140.221.8.50 eq 80 !ARG#8211 !! !lists.theseed.org permit tcp any host 140.221.8.115 eq 80 !ARG#37486 !!lists.icis.anl.gov permit tcp any host 140.221.8.38 eq 443 !ARG#8202 !! !lists.accessgrid.org permit tcp any host 140.221.8.39 eq 443 !ARG#8203 !! !lists.cosmea.mcs.anl.gov # permit tcp any host 140.221.8.40 eq 443 !ARG#8204 !! !lists.bgl.mcs.anl.gov permit tcp any host 140.221.8.41 eq 443 !ARG#8205 !! !lists.cogkit.org permit tcp any host 140.221.8.45 eq 443 !ARG#8207 !! !lists.i2u2.org permit tcp any host 140.221.8.46 eq 443 !ARG#8208 !! !lists.kbt.mcs.anl.gov permit tcp any host 140.221.8.48 eq 443 !ARG#8209 !! !lists.nmpdr.org permit tcp any host 140.221.8.49 eq 443 !ARG#8210 !! !lists.ogce.org permit tcp any host 140.221.8.50 eq 443 !ARG#8211 !! !lists.theseed.org permit tcp any host 140.221.8.115 eq 443 !ARG#37486 !!lists.icis.anl.gov #START lists.igsb.org Permits permit tcp any host 140.221.9.246 eq 80 !ARG#11081 !! permit tcp any host 140.221.9.246 eq 443 !ARG#11081 !! #END lists.igsb.org permits #START lists.cels.anl.gov Permits permit tcp any host 140.221.8.34 eq 80 !ARG#8200 !! permit tcp any host 140.221.8.34 eq 443 !ARG#8200 !! #END lists.cels.anl.gov # permit tcp any host 140.221.8.22 eq 25 ! ARG#9789 ! mailbouncer permit tcp any host 140.221.9.72 eq 22 ! ARG#489 ! shakey # breeze.mcs.anl.gov tcp 7777 permit tcp any host 140.221.9.85 eq 7777 !ARG#8001 !! over.mcs.anl.gov mud permit tcp any host 140.221.9.85 eq 7779 !ARG#8001 !! over.mcs.anl.gov mud permit tcp any host 140.221.9.85 eq 7780 !ARG#8001 !! over.mcs.anl.gov mud permit tcp any host 140.221.8.20 eq 7777 !ARG# 65483 ! permit tcp any host 140.221.8.20 eq 7779 !ARG# 65483 ! permit tcp any host 140.221.8.20 eq 7780 !ARG# 65483 ! hume? permit tcp any host 140.221.9.8 eq 8000 !ARG#866 permit tcp any host 140.221.9.8 eq 8002 !ARG#866 permit tcp any host 140.221.9.8 eq 8004 !ARG#866 permit tcp any host 140.221.9.8 eq 8006 !ARG#866 REVIEW THESE**** #login hosts permit tcp any host 140.221.8.4 eq 22 ! ARG#489 ! terra permit tcp any host 140.221.8.8 eq 22 ! ARG#489 ! pamby permit tcp any host 140.221.8.11 eq 22 ! ARG#489 ! harley.mcs.anl.gov permit tcp any host 140.221.9.199 eq 22 ! ARG#489 ! permit tcp any host 140.221.9.200 eq 22 ! ARG#489 ! permit tcp any host 140.221.9.205 eq 22 ! ARG#489 ! permit tcp any host 140.221.9.206 eq 22 ! ARG#489 ! ***** Fuzzy? # winunix.mcs.anl.gov (140.221.8.12) aka fuzzy permit tcp host 130.202.118.8 host 140.221.8.12 eq 137 permit tcp host 130.202.118.10 host 140.221.8.12 eq 137 permit tcp host 130.202.118.20 host 140.221.8.12 eq 137 permit tcp host 130.202.118.30 host 140.221.8.12 eq 137 permit tcp host 130.202.118.8 host 140.221.8.12 eq 139 permit tcp host 130.202.118.10 host 140.221.8.12 eq 139 permit tcp host 130.202.118.20 host 140.221.8.12 eq 139 permit tcp host 130.202.118.30 host 140.221.8.12 eq 139 permit tcp host 130.202.118.8 host 140.221.8.12 eq 445 permit tcp host 130.202.118.10 host 140.221.8.12 eq 445 permit tcp host 130.202.118.20 host 140.221.8.12 eq 445 permit tcp host 130.202.118.30 host 140.221.8.12 eq 445 ---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055

3 3

Fwd: INFO: IG Audit Update
by Tina Stanton-Piersanti 18 Mar '11

18 Mar '11

Do we need to prepare for this at all?? Tina. Begin forwarded message: > From: "Kwiatkowski, Matthew A." <mattk(a)anl.gov> > Date: March 16, 2011 12:30:51 PM CDT > To: "CSPR(a)anl.gov" <CSPR(a)anl.gov> > Subject: INFO: IG Audit Update > > All, > > CSPO has settled on dates for external and internal vulnerability > scanning. The external scanning will begin on or around March 28th > and continue for about a week. Internal Scanning will start on or > around May 2nd and continue for approximately 2 weeks. > > What can you do now? Please review external (outside the firewall > scan results in Scavenger), if there are any outstanding > vulnerabilities that need addressing and you need help, please > contact the CSPO. CSPO has been reviewing results and may be > contacting specific divisions. > > We have also gotten word that they will be focusing on webapps. > CSPO will increase our scanning using tools that the auditors will > be using to scan our webapps space. This may result in online forms > being submitted, so be on the watch-out for those. > > We have submitted a NO-scan list that will include items from our > last external audit (mostly visitor and non-ANL entities) which was > vetted by the CSPR’s and the CSPO. This list hasn’t had much churn > or change and we were very comfortable with the last audit results > generated from this list. > > CSPO has only come to an agreement for external scanning(most hosts > are protected by the Tier 1). The internal scanning agreement has > not been finalized. If you have production nets (Like APS) that > are running experiments during the early May timeframe, please let > the CSPO know so we can assess the risk of the auditors scanning > your nets. > > -- > Matt Kwiatkowski M.S.I.S. > Cyber Operations Lead > Argonne Cyber Security Program Office > > Argonne National Laboratory > http://www.anl.gov > 9700 South Cass Avenue > Bldg 240 Office 4110 > Argonne, IL 60439 > > mattk(a)anl.gov > Phone (630) 252-6465 > Fax (630) 252-9689 > > HEALTH WARNING: Care should be taken when lifting this e-mail, since > its mass, and thus its weight, is dependent on its velocity relative > to the user. >

2 1

Where's John R.
by Tina Stanton-Piersanti 18 Mar '11

18 Mar '11

He had a family emergency and will be dealing with that today. T.

1 0

Where's Jason
by Jason Hedden 18 Mar '11

18 Mar '11

I'm not able to make it in today. put me down for a sick day today. Something I ate, bug, curse, hex, I don't know what the cause is but the effects are not good. I'll be checking email periodically throughout the day. Jason Hedden

1 0

Bambi Box configuration issues
by Hunter Matthews 17 Mar '11

17 Mar '11

All, Per craigs request, an email describing the bambie box config issues. First, all the credit for this goes to Dan - he originally noticed. I only implemented what he suggested. The bambie storage boxes that we have contain 2x Areca ARC-1231ML raid controllers. These are at least pci-e 1.0 8x cards, and might be pci-e 2.0 8x cards. The supermicro motherboards in many of the bambies have 2x pci-e 2.0 8x slots, 1x pci-e 1.0 8x slot, and at least 1x pci-e 4x slot (and a couple of old style pci/pci-x slots). One bambie from ASA had the cards in one of the 2.0 8x slots and the 1.0 8x slot. For the second one I worked on they were in one of the 2.0 8x slot and the _4x_ slot. The reason for using the 1.0 8x slot is obvious when you look inside - the two 2.0 8x slots are immediately adjacent and using the 1.0 8x slot allows for plenty of air flow over the cards. It also provides a convenient place to put the BBU for the raid card, which on this model is on a small daughter card. I can't come up with any reason to have used the 4x slot. The fix is easy[1], but obviously moving the cards around requires a downtime. I did this at the same time as upgrading the firmware to try and fix some bad drive timeout issues. [1] Not quite as easy if like me you mounted them lowest in the rack, due to their weight. -- Hunter Matthews Unix Administrator Office: Bldg 221 Room B240 Argonne National Labs, MCS Key: F0F88438 / FFB5 34C0 B350 99A4 BB02 9779 A5DB 8B09 F0F8 8438 Never take candy from strangers. Especially on the internet.

1 0

LCRC userbase/account pages update
by John Valdes 17 Mar '11

17 Mar '11

This shouldn't cause any problems, but I'll mention it anyway, just in case. :) FYI, I made a couple of minor updates to LCRC's copy of the Accounts webpage which can change users' data in userbase: 1) The LCRC version of the Personal Account page never had a field for changing ones "unix" password, like the MCS version. I added a field for this now, although it is only available for users with an "LCRC" account_type; other users are directed to MCS's Accounts website for changing their "unix" password. The background for this is since LCRC's cluster (fusion) uses SSH keys for logging in, the "unix" password is only used for logging into the Accounts website. In the bad old days of Jazz, the LCRC Accounts website was getting passwords out of NIS (which were initially set to the crypted passwords from userbase), so if you wanted to change your password for accessing the Accounts site, you had to run yppasswd (at which point the crypt in userbase and the crypt in NIS would be out of sync). Since on fusion we're now using LDAP which has no password crypts, the LCRC Accounts website uses the crypts stored in userbase directly. However, non-MCS users had no way to change this password, since they couldn't log into MCS's version of the Accounts page. Now they do. Since it looks like the MCS Accounts page may store user passwords in places (eg, kerberos) in addition to userbase, the LCRC Accounts page redirects MCS users to the MCS Accounts page, so that their password doesn't get out of sync. 2) When an Argonne user requests an account via the LCRC Account Request page, the LCRC Account pages will now automatically set the argonne_username field in userbase for that user to the user's Argonne username. This field is displayed in the user's LCRC Personal Account page, but it isn't editable at the moment (as it is in MCS's version of that page). John

1 0

Where's Chris? Friday Edition
by Chris Walker 17 Mar '11

17 Mar '11

I'm gonna work from home tomorrow, so no one will hear my userbase screams..

1 0

TSM Cleanup
by Dan Olson 17 Mar '11

17 Mar '11

I'm slowly cleaning out old nodes that have no archive data. Please have a look at the below list. Let me know by the end of the day tomorrow if you want any of the backups from these nodes - I have already verified they have no archive data. NODE_NAME ARCHIVE_MB LASTACC_TIME ---------------------------------------------------------------- ----------- -------------------------- RALPH 0 2002-02-25 18:18:47.000000 TUMBLE 0 2002-04-11 15:41:20.000000 ZILDIAN 0 2002-10-01 07:47:16.000000 PS2DEVM.MCS.ANL.GOV 0 2002-12-22 20:55:21.000000 CARDKEY.MCS.ANL.GOV 0 2003-11-13 15:50:11.000000 CAVE0.MCS.ANL.GOV 0 2004-04-14 16:17:16.000000 TUECKE_THINKPADT40_WINXP 0 2004-06-01 11:04:53.000000 MIKESLAPTOP.MCS.ANL.GOV 0 2004-06-04 15:26:44.000000 DFS.MCS.ANL.GOV 0 2004-12-01 18:40:32.000000 LUSK-X31 0 2004-12-22 13:22:50.000000 UNIXHOME.MCS.ANL.GOV 0 2005-03-03 11:42:20.000000 GROPP-T23 0 2005-03-07 20:06:30.000000 CUTIE.MCS.ANL.GOV 0 2005-03-28 09:54:13.000000 CROW 0 2005-03-30 12:39:55.000000 MSDHERO.MSD.ANL.GOV 0 2005-04-11 09:44:33.000000 ZINGIBER.MCS.ANL.GOV 0 2005-04-15 12:04:47.000000 RANANTHA-T40P.MCS.ANL.GOV 0 2005-04-18 17:20:06.000000 CRUSOE.MCS.ANL.GOV 0 2005-08-02 12:38:21.000000 BAIR 0 2005-09-29 13:57:03.000000 BACON.MCS.ANL.GOV 0 2005-10-07 15:34:06.000000 MAB.MCS.ANL.GOV 0 2005-10-21 14:34:08.000000 SHREK 0 2005-12-01 16:38:57.000000 ANODYNE.MCS.ANL.GOV 0 2005-12-06 16:38:17.000000 ETBOSS.ET.ANL.GOV 0 2005-12-29 14:50:40.000000 RAYBAIRSPB.MCS.ANL.GOV 0 2006-01-02 16:33:01.000000 BERENICE 0 2006-01-06 17:21:42.000000 WINK 0 2006-02-03 16:30:50.000000 YANKEE.MCS.ANL.GOV 0 2006-03-03 10:06:30.000000 BARRYSMITH.MCS.ANL.GOV 0 2006-03-17 15:25:04.000000 NOKOMIS.MCS.ANL.GOV 0 2006-05-06 13:12:36.000000 GROPP-T42 0 2006-06-01 08:06:36.000000 AKHENATEN.MCS.ANL.GOV 0 2006-06-07 10:48:32.000000 FLAWLESS.MCS.ANL.GOV 0 2006-07-10 11:57:07.000000 KINDNESS-CPH.MCS.ANL.GOV 0 2006-08-08 14:21:39.000000 HOVLAND.MCS.ANL.GOV 0 2006-08-16 16:40:02.000000 GIZAH.MCS.ANL.GOV 0 2006-08-23 09:19:34.000000 CRUSHINATOR.MCS.ANL.GOV 0 2006-12-04 15:40:36.000000 PURCELL.MCS.ANL.GOV 0 2007-01-31 13:36:13.000000 LIZZARD.MCS.ANL.GOV 0 2007-03-19 09:11:47.000000 ZEUS 0 2007-03-23 16:45:12.000000 VIETA.MCS.ANL.GOV 0 2007-06-13 00:06:04.000000 HODGE-PODGE.MCS.ANL.GOV 0 2007-07-24 10:13:58.000000 GROPPMAC.MCS.ANL.GOV 0 2007-09-28 14:05:19.000000 FEIGL-LAPTOP 0 2007-10-01 17:16:51.000000 BIO-PPC-HEAD-4.MCS.ANL.GOV 0 2008-01-17 16:04:13.000000 LIFEBOOK2.MCS.ANL.GOV 0 2008-02-20 11:23:10.000000 BRAK 0 2008-03-10 13:07:09.000000 BUNTINAS-LINUX 0 2008-03-18 16:59:32.000000 SPINOZA.MCS.ANL.GOV 0 2008-04-04 22:15:03.000000 TG-PREZ.UC.TERAGRID.ORG 0 2008-04-26 21:08:47.000000 ---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055

1 0

vacation next week
by Kenneth Raffenetti 16 Mar '11

16 Mar '11

I'm going to take March 23-25 as vacation. Put me down for three days. Thanks, Ken

2 1

Where's Corby
by Corby Schmitz 16 Mar '11

16 Mar '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Wed: in till 3:30p Thu: working from home in the morning waiting on a delivery Fri: at 710 installing replacement RPM in the MREN-E1200, will work on that, restoring dialup connectivity and patching login.mren.org (will be at 710 till this is complete then to my office at LUC to finish out the day) Corby Schmitz corby(a)team-schmitz.org -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.16 (Darwin) iD8DBQFNgQEtQhpwH3ALVFERAsIbAJ4iO7wVTSl+yxVnluNtItOxLmtlugCgwpT1 gECoEb+Z5/P/4p1ZjQkv3FA= =sjBX -----END PGP SIGNATURE-----

1 0