December 2010 - Hpc-admins - mailman3.cels.anl.gov

[CELS Sysadmins] Farewell lunch for Jon Bernard tomorrow
by Tisha Stacey 22 Dec '10

22 Dec '10

It's time to send off another member of ALCF Operations. We'll have a farewell lunch for Jon Bernard tomorrow (Wednesday, 22-Dec.) at noon at Shikara (at 75th & Lemont). Let's plan to leave here around 11:45 and get there around noon. If you get there before me, I've called ahead; you'll be with the Stacey party. - Tisha _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 1

[CELS Sysadmins] Geek Beer?
by John Valdes 17 Dec '10

17 Dec '10

Any interest in GB today? _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

3 3

[CELS Sysadmins] Preventing root login attempts via crytocard
by Zbiegiel, Piotr T. 13 Dec '10

13 Dec '10

Over the past few weeks it has become clear that SSH brute force attacks are impacting the operation of the cryptocard servers. ALCF operations staff has been reporting intermittent problems logging into resources. Some of these incidents seem to correlate with periods of distributed SSH brute-force attacks against the lab. Most of these attacks target the user root. We decided to look into improving the situation by seeing if we could limit the number of root login attempts from ALCF systems and we'd like to pass along the information to other teams who use cryptocard. In the case of ALCF we cannot disable root logins on our externally accessible systems because we use the account to manage the systems internally. In our environment authentication for root is completed via a key-based authentication and root should never authenticate via cryptocard. This means that we needed to allow root to authenticate via keys but disable root's ability to authenticate via PAM (which facilitates cryptocard logins using the radius module). There are many ways to approach this problem but we wanted to share a couple solutions we've tested to encourage others who have externally accessible systems to consider preventing root login attempts from sending traffic to the cryptocard server and improving performance and stability (not to mention security) for everyone. 1) SSHD "match" option Newer versions of OpenSSH have a feature that allows conditional configuration options for the server. The version of OpenSSH installed on our systems would need to be upgraded to use this option. match user root KbdInteractiveAuthentication no Including the lines above at the end of the sshd_config would disallow PAM authentication for the root user only. This would prevent external users attempting to log in as root from even receiving the password prompt. match works with other criteria as well such as Host or Address. Address can accept cidr notation so you can disable root logins for all except internal systems. See the sshd_config man page for more info. 2) PAM module pam_listfile.so PAM includes a module that can allow or deny access to a list of users (among other criteria). You can add the module to the sshd authentication stack before PAM attempts radius and prevent the user root from ever being prompted for a password. auth requisite pam_listfile.so onerr=succeed item=user sense=deny file=/etc/ssh/ssh.denyusers The line above would be placed in the /etc/pam.d/sshd file before sshd attempts radius/cryptocard authentication. The "requisite" keyword causes PAM to immediately fail the login attempt as soon as this test fails. "required" still calls the other modules in the auth stack. The file "/etc/ssh/ssh.denyusers" can be named anything and contains the single entry "root". Again, the hostbased and key authentication is unencumbered for internal connections but external users attempting to login as root are not even presented with a password prompt. *Another interesting PAM module is pam_localuser.so which requires that the user be listed in the local /etc/passwd file before allowing PAM authentication to continue. Used with the requisite keyword would cut off the random account name guessing attacks as well. This assumes, of course, that all users on the system exist in /etc/passwd. The module probably won't work if LDAP is being used to user management. ALCF has tested and implemented a solution. The cryptocard server (at MCS) should be seeing practically no attempted root logins from ALCF systems at this time. If you'd like to try this on your systems please don't hesistate to contact me if you have any questions. Thanks! -- Piotr T Zbiegiel Cyber Security Engineer Argonne National Laboratory _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

[CELS Sysadmins] Reminder
by Craig Stacey 10 Dec '10

10 Dec '10

Rock Bottom Warrenville. Friday. 4PM. Be there or be elsewhere and lame. Sent from my mobile _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

2 2

Re: [HPC-Admins] [CELS Sysadmins] [systems] Beer
by John Valdes 03 Dec '10

03 Dec '10

Hmmm, well, it's now called the Irish Legend, so look for that sign rather than Stag's Head. John On Dec 3, 2010 5:28 PM, Craig Stacey <stace(a)mcs.anl.gov> wrote: We're gonna blame you or credit you whether you like it or not. So there. On Dec 3, 2010, at 5:15 PM, John Valdes wrote: > On Fri, Dec 03, 2010 at 05:10:56PM -0600, Andrew Cherry wrote: >> I'm OK with any of these, though it might be neat to try something new >> (e.g. Stag's Head). I don't know anything about it other than what >> JohnV posted a while back. If John can't make it, then we should >> probably table Stag's Head for another day. > > I'm in, and vote for Stag's Head, in the interest of trying something > different. Likewise, I know nothing about it, so I make no apologies > about the quality (or lack thereof :) ) of the food & beer. > > John > _______________________________________________ > This is the CELS Sysadmins mailing list. It is sent to memebers of: > core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. > Do not subscribe directly to this list. Thanks. _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

Re: [HPC-Admins] [CELS Sysadmins] [systems] Beer
by Andrew Cherry 03 Dec '10

03 Dec '10

FYI, Stag's Head is now called The Irish Legend Craig Stacey <stace(a)mcs.anl.gov> wrote: We're gonna blame you or credit you whether you like it or not. So there. On Dec 3, 2010, at 5:15 PM, John Valdes wrote: > On Fri, Dec 03, 2010 at 05:10:56PM -0600, Andrew Cherry wrote: >> I'm OK with any of these, though it might be neat to try something new >> (e.g. Stag's Head). I don't know anything about it other than what >> JohnV posted a while back. If John can't make it, then we should >> probably table Stag's Head for another day. > > I'm in, and vote for Stag's Head, in the interest of trying something > different. Likewise, I know nothing about it, so I make no apologies > about the quality (or lack thereof :) ) of the food & beer. > > John > _______________________________________________ > This is the CELS Sysadmins mailing list. It is sent to memebers of: > core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. > Do not subscribe directly to this list. Thanks. _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

[CELS Sysadmins] Beer
by Tisha Stacey 03 Dec '10

03 Dec '10

I can't decide on a suggestion, so you folks decide: 1. Stag's Head on Archer in Willow Springs (which may be haunted) 2. Finnegan's in Plainfield (which has a Stone Russian Imperial Stout vertical) 3. Gordon Biersch (which has tapped their Winterbock). - Tisha _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

5 4

[CELS Sysadmins] Holiday Party & Drinks
by tstanton＠mcs.anl.gov 01 Dec '10

01 Dec '10

The following meeting has been modified: Subject: Holiday Party & Drinks Organizer: "Tina Stanton-Piersanti" <tstanton(a)mcs.anl.gov> Location: Rock Bottom, Warrenville [MODIFIED] Time: Friday, December 10, 2010, 4:00:00 PM - 7:00:00 PM GMT -06:00 US/Canada Central Invitees: sysadmins(a)lists.cels.anl.gov; "Andrew Cherry" <acherry(a)alcf.anl.gov>; "Richard Bradshaw" <bradshaw(a)mcs.anl.gov>; "Craig Stacey" <stace(a)mcs.anl.gov> *~*~*~*~*~*~*~*~*~* We need an actual head count. Please RSVP, ASAP! We will also be doing a white elephant gift exchange as done in previous years. You and your guest can both participate if you wish! Bring a gift for each participant. We've got the upstairs room at Rock Bottom Warrenville (http://www.rockbottom.com/warrenville) on Friday Dec 10 starting at 4PM. We'll be going off their regular menu, I believe, which can be found here (http://www.rockbottom.com/sites/default/files/1076faxmenu1010.pdf -- just for reference, you don't need to order in advance). Spouses and significant others welcome! We (Tisha and I) will pick up most of the costs for the group, but if you can, kicking in $10 a head would be appreciated. Let's eat, drink, and be merry! == Craig (http://www.rockbottom.com/warrenville) on Friday Dec 10 starting at 4PM. We'll be going off their regular menu, I believe, which can be found here (http://www.rockbottom.com/sites/default/files/1076faxmenu1010.pdf -- just for reference, you don't need to order in advance). Spouses and significant others welcome! We (Tisha and I) will pick up most of the costs for the group, but if you can, kicking in $10 a head would be appreciated. Let's eat, drink, and be merry! == Craig _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

[CELS Sysadmins] Holiday Party & Drinks
by tstanton＠mcs.anl.gov 01 Dec '10

01 Dec '10

The following is a new meeting request: Subject: Holiday Party & Drinks Organizer: "Tina Stanton-Piersanti" <tstanton(a)mcs.anl.gov> Location: We need an actual head count. Please RSVP, ASAP! We've got the upstairs room at Rock Bottom Warrenville (http://www.rockbottom.com/warrenville) on Friday Dec 10 starting at 4PM. We'll be going off their regular menu, I believe, which can be found here (http://www.rockbottom.com/sites/default/files/1076faxmenu1010.pdf -- just for reference, you don't need to order in advance). Spouses and significant others welcome! We (Tisha and I) will pick up most of the costs for the group, but if you can, kicking in $10 a head would be appreciated. Let's eat, drink, and be merry! == Craig Time: Friday, December 10, 2010, 4:00:00 PM - 7:00:00 PM GMT -06:00 US/Canada Central Invitees: sysadmins(a)lists.cels.anl.gov *~*~*~*~*~*~*~*~*~* We need an actual head count. Please RSVP, ASAP! We will also be doing a white elephant gift exchange as done in previous years. You and your guest can both participate if you wish! Bring a gift for each participant. We've got the upstairs room at Rock Bottom Warrenville (http://www.rockbottom.com/warrenville) on Friday Dec 10 starting at 4PM. We'll be going off their regular menu, I believe, which can be found here (http://www.rockbottom.com/sites/default/files/1076faxmenu1010.pdf -- just for reference, you don't need to order in advance). Spouses and significant others welcome! We (Tisha and I) will pick up most of the costs for the group, but if you can, kicking in $10 a head would be appreciated. Let's eat, drink, and be merry! == Craig (http://www.rockbottom.com/warrenville) on Friday Dec 10 starting at 4PM. We'll be going off their regular menu, I believe, which can be found here (http://www.rockbottom.com/sites/default/files/1076faxmenu1010.pdf -- just for reference, you don't need to order in advance). Spouses and significant others welcome! We (Tisha and I) will pick up most of the costs for the group, but if you can, kicking in $10 a head would be appreciated. Let's eat, drink, and be merry! == Craig _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0