March 2015 - Core-sysadmins - mailman3.cels.anl.gov

Request AREQ0037271 Watch List completed: Block on globus.org IP Impacting Service
by Argonne Service Desk 31 Mar '15

31 Mar '15

Please do not respond to this message. If you need assistance, please contact the Service Desk. Hello, This request has been completed. If you need further assistance, please contact us. Please note that replying to this message will not reopen the ticket. Number: AREQ0037271 Customer: John Kordas Short Description: Block on globus.org IP Impacting Service Comments: 2015-03-31 11:33 CDT - Eugene RackowCustomer Comments The problem that caused this server to be blocked is that the 54.211.8.201 host at 2015-03-23 10:22:52 attempted to do a GET of /ftppub/myproxy/VERSION with a user-agent string of: () { foo;};echo; /bin/bash -c "expr 299663299665 / 3; echo 333:; uname -a; echo 333:; id;" Basicly testing to see if the server is vulnerable to CVE-2014-6271. This kind of activity will get the IP blocked. If the amazon servers are acting as a proxy, they should be preventing this kind of attack from being relayed through them. 2015-03-31 11:30 CDT - John KordasCustomer Comments reply from: kordas(a)ci.uchicago.edu Hi Matt, We launched the instance on 3/13. Jack On Tue, Mar 31, 2015 at 11:23 AM, Argonne Service Desk < argonne(a)service-now.com> wrote: > > > You can reply directly to this email. Please enter your response above > this line. > ------------------------------ > > > Hello, John Kordas, > > A new comment has been entered on your request. > > If this is a request for additional information, please reply at your > earliest convenience to assist us in fulfilling your request. > > Number: AREQ0037271 (LINK > <https://argonne.service-now.com/self_service/detail.do?sysparm_document_key…> > ) > Short Description: Block on globus.org IP Impacting Service > Comments: > ------------------------------ > *2015-03-31 11:22 CDT - Matthew Harvey*Customer CommentsSo it looks like > the IP 54.211.8.201 was getting blocked because it triggered the "Shell > Shock" Snort rule in our IDS on 3/23/15. > > I will remove the block but I just want to make sure that this is a false > positive before I do so. > > When did you take over this IP? > > -Matt > > > Thank you, > Argonne Service Desk > 630-252-9999, option 2 > help(a)anl.gov > > Ref:MSG0342585 > 2015-03-31 11:22 CDT - Matthew HarveyCustomer Comments So it looks like the IP 54.211.8.201 was getting blocked because it triggered the "Shell Shock" Snort rule in our IDS on 3/23/15. I will remove the block but I just want to make sure that this is a false positive before I do so. When did you take over this IP? -Matt Thank you, Argonne Service Desk 630-252-9999, option 2 help(a)anl.gov Ref:MSG0342604

1 0

[CELS Sysadmins] Security Meeting
by Craig Stacey 31 Mar '15

31 Mar '15

Reminder that on Wednesday we're scheduled to have the group security meeting. This meeting should go ahead whether I'm available or not. Take some time now to look over your items in scavenger: https://webapps.inside.anl.gov/scavenger/index.php Knock out what you can now. At the meeting on Wednesday, plow through the remaining items and let's get the count of open items as low as we can. Thanks!

2 1

Announce post from [email protected] requires approval
by announce-owner＠mcs.anl.gov 30 Mar '15

30 Mar '15

As list administrator, your authorization is requested for the following mailing list posting: List: Announce(a)mcs.anl.gov From: kconrad(a)anl.gov Subject: Re: [MCS Staff] MCS Seminar Today - Ricardo Vinuesa Reason: Post by non-member to a members-only list At your convenience, visit: https://lists.mcs.anl.gov/mailman/admindb/announce to approve or deny the request.

1 0

mcs-staff post from [email protected] requires approval
by mcs-staff-owner＠mcs.anl.gov 30 Mar '15

30 Mar '15

As list administrator, your authorization is requested for the following mailing list posting: List: mcs-staff(a)mcs.anl.gov From: oanam(a)kth.se Subject: RE: MCS Seminar Today - Ricardo Vinuesa Reason: Post by non-member to a members-only list At your convenience, visit: https://lists.mcs.anl.gov/mailman/admindb/mcs-staff to approve or deny the request.

1 0

mcs-staff post from [email protected] requires approval
by mcs-staff-owner＠mcs.anl.gov 30 Mar '15

30 Mar '15

As list administrator, your authorization is requested for the following mailing list posting: List: mcs-staff(a)mcs.anl.gov From: oanam(a)kth.se Subject: RE: MCS Seminar Today - Ricardo Vinuesa Reason: Post by non-member to a members-only list At your convenience, visit: https://lists.mcs.anl.gov/mailman/admindb/mcs-staff to approve or deny the request.

1 0

Where's Dan?
by Murphy-Olson, Daniel E. 27 Mar '15

27 Mar '15

I'll be on vacation in Wisconsin leaving today, returning on April 6th. If anything comes up that can't be handled with the normal issue routing, or for any management issues please contact Craig. Dan

1 0

[CELS Sysadmins] where's Linda 3/27
by Linda Winkler 27 Mar '15

27 Mar '15

Working downtown today on MREN gear lw

1 0

[CELS Sysadmins] Power work in the data center scheduled for April 20.
by Stacey, Craig J. 26 Mar '15

26 Mar '15

Right now it's looking like April 20th is when they're going to be performing some power work in the data center. Expect an announcement from Fred soon, once the scope of work is finalized, but here's the reader's digest version: * They'll be switching everything that's on the "B" power feed over to the "A" power feed. This is not a bumpless switch, there will be a blip on the order of milliseconds. This blip will affect every PDU in the room on the B feed. This includes all the UPS PDUs, though I don't at the moment have a list of which other PDUs it includes. In any case, though, the circuits on the UPS PDUs will ride out the blip just fine. Anything that's on utility power drawn from the B feed will feel the blip. If the equipment is dual-fed from UPS and Utility, it should be fine. If the equipment is fed solely from utility, or dual-fed but one of the feeds is from the A feed, it should also be fine. I'm reasonably sure Beagle's 408V feed will be affected, however, and I recommend a shutdown be scheduled. Mira will be shutting down, I believe. * Once we are on the "A" feed only, they will then throw the UPS into bypass mode, which means the UPS circuits will remain up, but will *not* be battery-backed. This will be a bumpless switch. * The work is expected to last the day, and at the end of the work, they will again switch the affected PDUs back from the A feed to the B feed. By this point, the UPS work will be complete, and the same situation as in the first bullet applies here. UPS circuits will ride out the bump, utility circuits will not. A more detailed description of the work will follow through official data center management channels, but I wanted to make sure everyone here had as much notice as possible to plan accordingly. -- Craig

1 0

Non-root su attempt on kronwall,kronwall by mdreher
by nobody＠mcs.anl.gov 26 Mar '15

26 Mar '15

User mdreher(7167) attempted to su on kronwall,kronwall at 2015-03-26 14:31:12 UTC: <85>Mar 26 09:31:12 kronwall su[3611]: pam_unix(su:auth): authentication failure; logname=mdreher uid=7167 euid=0 tty=/dev/pts/0 ruser=mdreher rhost= user=root

1 0

Non-root su attempt on kronwall,kronwall by mdreher
by nobody＠mcs.anl.gov 25 Mar '15

25 Mar '15

User mdreher(7167) attempted to su on kronwall,kronwall at 2015-03-25 20:15:51 UTC: <85>Mar 25 15:15:51 kronwall su[2748]: pam_unix(su:auth): authentication failure; logname=mdreher uid=7167 euid=0 tty=/dev/pts/0 ruser=mdreher rhost= user=root

1 0