January 2013 - Core-students - mailman3.cels.anl.gov

Where's Ti?
by Ti Leggett 08 Jan '13

08 Jan '13

I'll be in a Cray meeting all morning so I won't be at the sync.

1 0

Fwd: ** PROBLEM Service Alert: yubiauth/diskspace is WARNING **
by Dan Olson 08 Jan '13

08 Jan '13

This was caused by rsyslog queue files piling up. It looks like puppet has a config that specifies a 1g queue limit. For at least yubiauth that is way too generous. I cleared the queue and pushed it down to 10m. I didn't get to the bottom of why the syslog messages were piling up.. yet. Maybe the specification for woodhick or the ssh loghost is incorrect? ---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055 ----- Forwarded Message ----- From: nagios(a)mcs.anl.gov To: dolson(a)mcs.anl.gov Sent: Monday, January 7, 2013 4:25:17 PM Subject: ** PROBLEM Service Alert: yubiauth/diskspace is WARNING ** ***** Nagios ***** Notification Type: PROBLEM Service: diskspace Host: yubiauth Address: yubiauth.mcs.anl.gov State: WARNING Date/Time: Mon Jan 7 16:25:17 CST 2013 Additional Info: DISK WARNING - free space: / 499 MB (10% inode=45%): /lib/init/rw 505 MB (100% inode=99%): /dev 500 MB (99% inode=99%): /dev/shm 505 MB (100% inode=99%): URL: https://peer.mcs.anl.gov/nagios3/cgi-bin/extinfo.cgi?type=2&host=yubiauth.m…

2 1

hp meet?
by Dan Olson 07 Jan '13

07 Jan '13

Our rep from Holman's reached out to me and would like to meet to discuss HPs hardware lineup. Anyone interested? They will be onsite next Tuesday all day and Wednesday AM. ---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055

3 7

where's Linda 1/7
by Linda Winkler 07 Jan '13

07 Jan '13

taking half day of vacation this afternoon lw

1 0

Where's Craig
by Craig Stacey 07 Jan '13

07 Jan '13

For my CI peeps, I have a meeting that will prevent me from making the sync this morning, so we'll do an e-mail sync. I also have a 1PM dentist appointment. I plan to be bak in the office afterwards, unless it runs long enough to make that not worthwhile in which case I'll finish up at home. -- Craig

1 0

RADIUS testing
by Ti Leggett 04 Jan '13

04 Jan '13

I've gone through the RADIUS configuration with a fine toothed comb and found all kinds of inconstancies and fragilities that I've think I've corrected. Gone are the days of static RADIUS huntgroups, users, and hints. Welcome the days of using LDAP for decision making information. Here are the features that have been added: * LDAP lookups for group membership to determine rights (e.g., if you're in the sudoers unix group you get Admin privs and Cisco level 15) - Right now these RADIUS attributes are specified in a config, but I think they can be pushed up in to LDAP * LDAP lookups for authorization - if you're not in LDAP you get rejected straightaway. No authentication is passed up to the actual auth servers (Yubi / CC) and this should help with the DoS things taking out the actual auth servers * Authentication attempts actually log out now. Unfortunately PAM RADIUS attempts don't generate accounting records, though I bet Cisco and other native RADIUS attempts would. Still left to do: I still need to test auth attempts agains CIS cryptocard and then ANL domain. I'm waiting on getting the access in place for the hubs on the CIS side. I'd like to test how durable this configuration is. I want some way to simulate a DoS and see at what point the service falls over and dies or starts dropping requests. Does anyone have any ideas about how to do this? I know nmap has some scripts to simulate brute force and dos attacks. Any other ideas? I also need to get the RADIUS LDAP schema in place on the LDAP servers so I can fully test all the LDAP lookups. Here's a list of LDAP servers I know about: kerdap.mcs.anl.gov kerdap-2.mcs.anl.gov hub-221.mcs.anl.gov hub-240.mcs.anl.gov There's a fusion slave, but I don't know off hand what that host is. Are there any others? They all need the new schema before any DNs use them or replication will break to the slave.

1 0

Where's Craig
by Craig Stacey 04 Jan '13

04 Jan '13

Wednesday morning I have a doctor's appointment, after which I will be working from my office at the UofC for the rest of the day. -- Craig

1 0

where's Linda 1/4
by Linda Winkler 04 Jan '13

04 Jan '13

Heading to UIC this afternoon to replace a piece of IWIRE gear. lw

1 0

cryptocard server down
by Dan Olson 03 Jan '13

03 Jan '13

The cryptocard server will be going down at 5:30pm for MCS and ALCF. We are currently in the process of restoring the database and the ETA is 7pm. If you have a Yubikey that shouldn't be affected. ---- Daniel Murphy-Olson Systems Administrator Mathematics & Computer Science Division Argonne National Laboratory 630-252-0055

1 0

Where's hunter
by Hunter Matthews 03 Jan '13

03 Jan '13

I'm on vacation through monday. I thought I had sent that through before I left but Craig at my front door informs me otherwise! It's a rare breed of manager that will check up on his people in person, and we're all better for it. Sent from my iPad

1 0