January 2004 - Ag-tech - mailman3.cels.anl.gov

possible backdoor attack.
by Don Lewis 30 Jan '04

30 Jan '04

Please look into your Windows 2k and windows XP computers WINNT/SYSTEM32 folders and look for these three folders, NNP ' a normal network monitor and trace folder. MUI ' a Multi-User Interface folder OS2 We have found these folders with a dameware installed which we believe came just before we blocked port 6129 per a Sans.Org alert. The infiltrators are setting up ftp servers with dvd movies, porn, music and programs. The dameware gathers a great deal of information about the network. I realize this description is vague but we just ran across it. Having all the latest Windows security, servicepaks etc installed did not prevent it as best we know. For the weekend we are trying to turn off all nonessential computers. Hopefully this will not be a problem for the AG community. Thank you for your time, Don Lewis In MUI there may be many or few numbered folders. Inside these folders may be a series of repeatable DLL's EXPIRExx.dll or something like that. NNP >===== Original Message From Robert Olson <olson(a)mcs.anl.gov> ===== >If you send me your client logfile: > >\Documents and Settings\<user>\Application Data\AccessGrid\venueclient.log > >I'll take a look and see what I can see. If you moved things around in the >certRepo dir you've likely caused problems, yes. If you did that, remove >the certREpo dir and try the import again. > >--bob > >At 02:36 PM 1/30/2004, Darin Oman wrote: >>I get this error when I try to import a certificate on a Windows machine. >>The cert has been exported from Linux. I tried moving various certs and >>.pem files around, so I probably screwed things up even worse, but I still >>get the same error. Any ideas? >> >>Thanks, >>Darin Don Lewis Senior Computer Specialist Graduate Institute of Technology ETAS 335A, 2801 South University Avenue University of Arkansas at Little Rock 72204 (501) 569-8016 fax: (501) 569-8039 djlewis(a)ualr.edu

1 0

Re: [AG-TECH] Can you see me in the Test room
by Rabarison Monika Klara 30 Jan '04

30 Jan '04

Supreeya, I just turned off my node. I saw CHL-HPVC node there since you enter the Test Room. However I did not have it in RAT. Monika On Fri, 30 Jan 2004, Supreeya Miller wrote: > Dear all, > > We're still experiencing multicast problem. > Could someone please verify that CHL-node is being seen or not in the Test > room? > > Thank you very much. > > Supreeya Miller > Visualization Researcher, System Administrator, and Access Grid Coordinator > Center of Higher Learning > Building 1103 > Stennis Space Center, MS 39529 > 228-688-2900 > Internal Mail Box: 10002 > Supreeya.Miller(a)usm.edu > --------------------------------------------------------------------- Monika Rabarison Systems Administrator Information Technology/HPCVI Jackson State University Office:(601)979-5933 SciVis Lab:(601)979-1061 JSUvisNode:(601)979-1056

1 0

RE: [AG-TECH] Error occurred during certificate import
by Robert Olson 30 Jan '04

30 Jan '04

At 04:10 PM 1/30/2004, Carter, Tameka wrote: >Hey, > >A friend of mine had the same problem. We tried deleting the certrepo >directory and importing again. I was then told the key was not with the >certificate. We then tried to request another certificate 4-5 days >ago. We have not gotten it yet. If you delete teh certrepo after doing a request of a certificate, you will indeed get that error - deleting the certrepo directory will delete the private key for the requested certificate, leaving it useless. > >On another note, is it the case that any certificate works? I have a DOE >science grid certificate I have been wondering about. Yup, you can use that. You need to import the DOE science grid CA certs first, then you can import the DOE cert itself. --bob

1 0

Can you see me in the Test room
by Supreeya Miller 30 Jan '04

30 Jan '04

Dear all, We're still experiencing multicast problem. Could someone please verify that CHL-node is being seen or not in the Test room? Thank you very much. Supreeya Miller Visualization Researcher, System Administrator, and Access Grid Coordinator Center of Higher Learning Building 1103 Stennis Space Center, MS 39529 228-688-2900 Internal Mail Box: 10002 Supreeya.Miller(a)usm.edu

1 0

RE: [AG-TECH] Error occurred during certificate import
by Carter, Tameka 30 Jan '04

30 Jan '04

Hey, A friend of mine had the same problem. We tried deleting the certrepo directory and importing again. I was then told the key was not with the certificate. We then tried to request another certificate 4-5 days ago. We have not gotten it yet. On another note, is it the case that any certificate works? I have a DOE science grid certificate I have been wondering about. Cheers, Tameka -----Original Message----- From: Robert Olson [mailto:[email protected]] Sent: Friday, January 30, 2004 4:52 PM To: darin(a)ucar.edu; ag-tech(a)mcs.anl.gov Subject: Re: [AG-TECH] Error occurred during certificate import If you send me your client logfile: \Documents and Settings\<user>\Application Data\AccessGrid\venueclient.log I'll take a look and see what I can see. If you moved things around in the certRepo dir you've likely caused problems, yes. If you did that, remove the certREpo dir and try the import again. --bob At 02:36 PM 1/30/2004, Darin Oman wrote: I get this error when I try to import a certificate on a Windows machine. The cert has been exported from Linux. I tried moving various certs and .pem files around, so I probably screwed things up even worse, but I still get the same error. Any ideas? Thanks, Darin

1 0

Re: [AG-TECH] Error occurred during certificate import
by Darin Oman 30 Jan '04

30 Jan '04

Thanks for the offer, Bob, but I just got it to work. I ended up uninstalling the toolkit and deleting any leftovers I could find relating to the AG or Globus. Not very technical, but it worked. Darin On 1/30/2004 at 3:52 PM Robert Olson wrote: If you send me your client logfile: \Documents and Settings\<user>\Application Data\AccessGrid\venueclient.log I'll take a look and see what I can see. If you moved things around in the certRepo dir you've likely caused problems, yes. If you did that, remove the certREpo dir and try the import again. --bob At 02:36 PM 1/30/2004, Darin Oman wrote: I get this error when I try to import a certificate on a Windows machine. The cert has been exported from Linux. I tried moving various certs and .pem files around, so I probably screwed things up even worse, but I still get the same error. Any ideas? Thanks, Darin

1 0

Re: [AG-TECH] Error occurred during certificate import
by Robert Olson 30 Jan '04

30 Jan '04

If you send me your client logfile: \Documents and Settings\<user>\Application Data\AccessGrid\venueclient.log I'll take a look and see what I can see. If you moved things around in the certRepo dir you've likely caused problems, yes. If you did that, remove the certREpo dir and try the import again. --bob At 02:36 PM 1/30/2004, Darin Oman wrote: >I get this error when I try to import a certificate on a Windows machine. >The cert has been exported from Linux. I tried moving various certs and >.pem files around, so I probably screwed things up even worse, but I still >get the same error. Any ideas? > >Thanks, >Darin

1 0

Error occurred during certificate import
by Darin Oman 30 Jan '04

30 Jan '04

I get this error when I try to import a certificate on a Windows machine. The cert has been exported from Linux. I tried moving various certs and .pem files around, so I probably screwed things up even worse, but I still get the same error. Any ideas? Thanks, Darin

1 0

Re: [AG-TECH] multicast problems? can anyone see me in the TEST ROOM?
by Gurcharan.S.Khanna＠Dartmouth.EDU 30 Jan '04

30 Jan '04

hi, thanks, all, who responded. things seem to be back to normal, i think. i can see and be seen in the Test Room. turns out they turned off PIM last night due to some problems but neglected to let me know, so i was running around all morning trying to narrow down the problem. i'm waiting to see if it's been turned back on, which would explain things working again. however, i'm still experiencing lots of delay (according to the beacon) and lots of packet loss (according to rat). i still need to figure out what's going on there. thanks again to all who responded, -gurcharan --- Gurcharan S. Khanna wrote: hi, i'm trying to debug a problem this morning. i can't receive any streams from outside dartmouth and even within dartmouth it's inconsistent. the beacon webpage shows no connectivity to the other sites; but internet detective says i do have connectivity. but there is definitely something wrong. is there a research computing stream showing up in the TEST ROOM? that would tell me something anyway. thanks, -gurcharan =========================== Gurcharan S. Khanna, Associate Director Research Computing, Dartmouth College gkhanna(a)dartmouth.edu office: 603-646-1644 http://research.dartmouth.edu/ http://www.dartmouth.edu/~gkhanna --- end of quote ---

1 0

RE: [AG-TECH] multicast problems? can anyone see me in the TEST ROOM?
by Supreeya Miller 30 Jan '04

30 Jan '04

Gurcharan, I can see your thumbnail with a 2-shade-of-blue-screen. Supreeya Miller Visualization Researcher, System Administrator, and Access Grid Coordinator Center of Higher Learning Building 1103 Stennis Space Center, MS 39529 228-688-2900 Internal Mail Box: 10002 Supreeya.Miller(a)usm.edu -----Original Message----- From: owner-ag-tech(a)mcs.anl.gov [mailto:[email protected]]On Behalf Of Gurcharan S. Khanna Sent: Friday, January 30, 2004 9:05 AM To: ag-tech(a)mcs.anl.gov Subject: [AG-TECH] multicast problems? can anyone see me in the TEST ROOM? hi, i'm trying to debug a problem this morning. i can't receive any streams from outside dartmouth and even within dartmouth it's inconsistent. the beacon webpage shows no connectivity to the other sites; but internet detective says i do have connectivity. but there is definitely something wrong. is there a research computing stream showing up in the TEST ROOM? that would tell me something anyway. thanks, -gurcharan =========================== Gurcharan S. Khanna, Associate Director Research Computing, Dartmouth College gkhanna(a)dartmouth.edu office: 603-646-1644 http://research.dartmouth.edu/ http://www.dartmouth.edu/~gkhanna

1 0