December 2013 - Core-students - mailman3.cels.anl.gov

FYI - Havij Exploit response
by rackow＠anl.gov 31 Dec '13

31 Dec '13

Got a note for DOE JC3 indicating that on Dec 26 there was a Havij SQL injection attack attempt from 130.185.217.253 against 140.221.6.95 Digging into the logs, here are a few of the attempts they are making. 130.185.217.253 www.mcs.anl.gov - [26/Dec/2013:08:15:59 -0600] "GET /research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E HTTP/1.1" 200 24760 "-" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" [Thu Dec 26 08:16:08 2013] [error] [client 130.185.217.253] File does not exist: /www/www.mcs.anl.gov/content/research/LANS/people/\\"http:, referer: http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3… 130.185.217.253 www.mcs.anl.gov - [26/Dec/2013:08:16:08 -0600] "GET /research/LANS/people/%5C%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%5C%22 HTTP/1.1" 404 9767 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3…" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" 130.185.217.253 www.mcs.anl.gov - [26/Dec/2013:08:16:08 -0600] "GET /uploads/cels/images/people/satish_balaysm.png HTTP/1.1" 200 122321 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3…" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" 130.185.217.253 www.mcs.anl.gov - [26/Dec/2013:08:16:09 -0600] "GET /uploads/cels/images/people/Jie%20Chen.jpg HTTP/1.1" 200 11993 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3…" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" 130.185.217.253 www.mcs.anl.gov - [26/Dec/2013:08:16:10 -0600] "GET /uploads/cels/images/people/constantinescu-e_400.jpg HTTP/1.1" 200 31451 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3…" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" 130.185.217.253 www.mcs.anl.gov - [26/Dec/2013:08:16:10 -0600] "GET /uploads/cels/images/people/p_hovland.png HTTP/1.1" 200 146016 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3…" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" I'm concerned that the referer links in some of these appear to be coming from MCS server with defiantart links in it. Possibly others as well. --Gene

2 2

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 26 Dec '13

26 Dec '13

This is the mail system at host mailrelay.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <freelove(a)msn.com>: host mx3.hotmail.com[65.55.92.184] said: 550 Requested action not taken: mailbox unavailable (in reply to RCPT TO command)

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 26 Dec '13

26 Dec '13

This is the mail system at host mailrelay.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <behappy(a)yahoo.com>: host mta5.am0.yahoodns.net[98.138.112.38] said: 554 delivery error: dd This user doesn't have a yahoo.com account (behappy(a)yahoo.com) [-5] - mta1001.mail.ne1.yahoo.com (in reply to end of DATA command)

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 26 Dec '13

26 Dec '13

This is the mail system at host mailrelay.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <unlove(a)gmail.com>: host gmail-smtp-in.l.google.com[74.125.142.27] said: 552-5.2.2 The email account that you tried to reach is over quota. Please direct 552-5.2.2 the recipient to 552 5.2.2 http://support.google.com/mail/bin/answer.py?answer=6558 lo5si36140202icc.71 - gsmtp (in reply to RCPT TO command)

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 26 Dec '13

26 Dec '13

This is the mail system at host mailrelay.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <pitfighter(a)hotmail.com>: host mx3.hotmail.com[65.55.37.72] said: 550 Requested action not taken: mailbox unavailable (in reply to RCPT TO command)

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 26 Dec '13

26 Dec '13

This is the mail system at host mailrelay.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <friend35(a)hotmail.com>: host mx1.hotmail.com[65.54.188.72] said: 550 Requested action not taken: mailbox unavailable (in reply to RCPT TO command)

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 26 Dec '13

26 Dec '13

This is the mail system at host mailrelay.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <friend35(a)hotmail.com>: host mx3.hotmail.com[65.54.188.110] said: 550 Requested action not taken: mailbox unavailable (in reply to RCPT TO command)

1 0

Mass Acknowledgement Executed
by Nagios 20 Dec '13

20 Dec '13

Acknowledged Alerts: by stace reason: Acking Alerts - Craig's on it. [1387570917] ACKNOWLEDGE_SVC_PROBLEM;gust.mcs.anl.gov;inside.cels.anl.gov;1;0;0;stace;Acking Alerts - Craig's on it. [1387570917] ACKNOWLEDGE_SVC_PROBLEM;gust.mcs.anl.gov;press3.mcs.anl.gov;1;0;0;stace;Acking Alerts - Craig's on it. [1387570917] ACKNOWLEDGE_SVC_PROBLEM;gust.mcs.anl.gov;press3.mcs.anl.gov-secure;1;0;0;stace;Acking Alerts - Craig's on it. [1387570917] ACKNOWLEDGE_SVC_PROBLEM;gust.mcs.anl.gov;tcs.anl.gov;1;0;0;stace;Acking Alerts - Craig's on it.

1 0

[CELS Sysadmins] "No Changes on the Friday Before a Holiday" pizza lunch.
by John 'Skip' Reddy 19 Dec '13

19 Dec '13

A reminder and update: Update: WHERE: Conf Center, room 1406/1407 WHAT: Pizza and Soda Lunch WHEN: Friday, 20th, from 12:00PM CST (18:00 UTC) WHO: Sysadmins, and everyone else WHY: Because reasons I'll be putting out a few "friendly" card games if people are interested. I've got Munchkin and Killer Bunnies and the Quest for the Magic Carrot, a few decks of regular cards. I will *not* be putting out Cards Against Humanity, because that would be an HR incident that wouldn't even wait to happen. -Skip -- John "Skip" Reddy, jreddy(a)alcf.anl.gov Office 1120, Bldg 240 9700 S. Cass Ave Argonne, IL 60439 Office: 630-252-1377 “That's the thing about people who think they hate computers. What they really hate is lousy programmers.” ― Larry Niven _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of core-admins(a)mcs.anl.gov and systems(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

Fwd: [mcs-systems #192451] INFO: You have been added to a watch list for Request AREQ0011188 has been completed
by Stanton-Piersanti, Tina Joy 19 Dec '13

19 Dec '13

This isn't how I remember this all panning out w/ the CSI and the software purchases, as we discussed this morning? T > > > > Site licensed software is not ordered through AMOS anymore. They don't track equipment CSI numbers now to be able to do that. > CIS systems worked with MCS systems to get the software installed on Carolyn Phillips machine. > It's done now. > > ----- Original Message ----- > From: "Tina Joy Stanton-Piersanti" <tstanton(a)mcs.anl.gov> > To: "Carolyn Peters" <cpeters(a)mcs.anl.gov> > Cc: "<systems(a)mcs.anl.gov> Systems" <systems(a)mcs.anl.gov> > Sent: Thursday, December 19, 2013 4:17:55 PM > Subject: Fwd: [mcs-systems #192451] INFO: You have been added to a watch list for Request AREQ0011188 has been completed > > Carolyn this needs to be ordered through AMOS for Carolyn Peters? Has it been done so? > > > T > > > > > Begin forwarded message: > > > > From: Argonne Service Desk < argonne(a)service-now.com > > > Subject: [mcs-systems #192451] INFO: You have been added to a watch list for Request AREQ0011188 has been completed > > Date: December 19, 2013 4:00:14 PM CST > > To: < mcs-purchase(a)mcs.anl.gov >, < systems(a)mcs.anl.gov >, < cphillips(a)mcs.anl.gov >, < ehaus(a)anl.gov > > > Reply-To: < systems(a)mcs.anl.gov >, Argonne Service Desk < argonne(a)service-now.com > > > > Date: 2013-12-18 15:57 CST > Closed: 2013-12-19 15:59 CST > Number: AREQ0011188 > State: Complete > Click here to view Request: AREQ0011188 > Short Description: Re: [mcs-purchase #189019] Software for Mac > Description: received from: cpeters(a)mcs.anl.gov > > Can someone in CIS and MCS Systems please help Carolyn Phillips get the software she needs? > The first request came on Nov. 21. > > ----- Original Message ----- > From: "Carolyn Peters" < cpeters(a)mcs.anl.gov > > To: " systems(a)mcs.anl.gov Systems" < systems(a)mcs.anl.gov > > Cc: mcs-purchase(a)mcs.anl.gov , "Mary Edylyn M. Haus" < ehaus(a)anl.gov >, "Carolyn L. Phillips" < cphillips(a)mcs.anl.gov > > Sent: Thursday, December 12, 2013 1:49:16 PM > Subject: Re: [mcs-purchase #189019] Software for Mac > > I asked Edy about this today and it's possible to get this software from CIS through MCS Systems. > > A CIS Mac admin would have to contact MCS systems to get the software to Carolyn Phillips and also get Eracent on her machine to track the software. > > Lab licensed software is now purchased by subscription and renewed every year. Edy mentioned it might be better to subscribe to a suite of Adobe products instead of subscribing to each one separately. > > These are the programs that Carolyn wants: > > > Adobe Acrobat Professional > Adobe Illustrator CS6 > not sure if you need this info, but here it is: > > > Cost Code 03065-26-145 > CIS 0350252 > > Let me know if there's anything I need to do. > Carolyn > > ----- Original Message ----- > From: "Carolyn L. Phillips" < cphillips(a)mcs.anl.gov > > To: "Carolyn Peters" < cpeters(a)mcs.anl.gov > > Cc: mcs-purchase(a)mcs.anl.gov , "Mary Edylyn M. Haus" < ehaus(a)anl.gov > > Sent: Monday, December 9, 2013 11:30:51 AM > Subject: Re: [mcs-purchase #189019] Software for Mac > > I have not heard any more on this issue. > > Has this been figured out? I would appreciate being able to get the Adobe Professional and Illustrator CS6 package soon. > > -Carolyn > > > ----- Original Message ----- > From: "Carolyn L. Phillips" < cphillips(a)mcs.anl.gov > > To: "Carolyn Peters" < cpeters(a)mcs.anl.gov > > Cc: mcs-purchase(a)mcs.anl.gov , "Mary Edylyn M. Haus" < ehaus(a)anl.gov > > Sent: Tuesday, December 3, 2013 9:45:55 AM > Subject: Re: [mcs-purchase #189019] Software for Mac > > Did this get figured out? > > Thanks, > Carolyn > > ----- Original Message ----- > From: "Carolyn Phillips" < cphillips(a)mcs.anl.gov > > To: "Carolyn Peters" < cpeters(a)mcs.anl.gov > > Cc: mcs-purchase(a)mcs.anl.gov , "Mary Edylyn M. Haus" < ehaus(a)anl.gov > > Sent: Friday, November 22, 2013 5:03:54 PM > Subject: Re: [mcs-purchase #189019] Software for Mac > > I think I gave you the right number > > > [image/jpeg:image.jpeg] > > > > Sent from my iPhone > > > > On Nov 22, 2013, at 4:33 PM, Carolyn Peters < cpeters(a)mcs.anl.gov > wrote: > > Hi Edy, Turns out I can't order the Acrobat on AMOS either. The CSI number is not tracked in the system. Carolyn > > ----- Original Message ----- > From: "Carolyn Peters" < cpeters(a)mcs.anl.gov > > To: "Mary Edylyn M. Haus" < ehaus(a)anl.gov > > Cc: mcs-purchase(a)mcs.anl.gov , "Carolyn L. Phillips" < cphillips(a)mcs.anl.gov > > Sent: Friday, November 22, 2013 4:03:17 PM > Subject: Re: [mcs-purchase #189019] Software for Mac > > Hi Edy, Is there a site license for Adobe Illustrator? Carolyn Phillips (PR 223327) would like a copy for Mac, cost code below. I'll go ahead and order Acrobat on AMOS for her. Thanks, Carolyn > > ----- Original Message ----- > From: "Carolyn L. Phillips" < cphillips(a)mcs.anl.gov > > To: purchase(a)mcs.anl.gov > Sent: Thursday, November 21, 2013 4:17:08 PM > Subject: [mcs-purchase #189019] Software for Mac > > I would like to purchase > Adobe Acrobat Professional > Adobe Illustrator CS6 > > > Cost Code 03065-26-145 > CIS 0350252 > > > Best, > Carolyn > > > > The request you were added to the watch list for is now complete. > > > Thank you, > CIS Service Desk > 630-252-9999 option 2 > > > 2013-12-19 15:59 CST - Fanping ZhuCustomer Comments > The Adobe Acrobat Pro for Mac v 11 and Illustrator CC have been installed on Carolyn Phillips's Mac with help by Martini Henderson of MCS helpdesk. > > > > Ref:MSG0017257 >

2 2