Dear Leslie,
This sounds like it is an incident which should be reported according to the
incident response agreement (see
http://proj-lcg-security.web.cern.ch/proj-lcg-security/incident_response.htm
l)
You are supposed to warn all sites via a mail to
"[log in to unmask]"
A mail to lcg-rollout list is not sufficient.
Please can you do this?
Many thanks and good luck with the follow up,
Dave Kelsey
------------------------------------------------
Dr David Kelsey
Particle Physics Department
Rutherford Appleton Laboratory
Chilton, DIDCOT, OX11 0QX, UK
e-mail: [log in to unmask]
Tel: [+44](0)1235 445746 (direct)
Fax: [+44](0)1235 446733
------------------------------------------------
-----Original Message-----
From: LHC Computer Grid - Rollout [mailto:[log in to unmask]] On
Behalf Of Leslie Groer
Sent: 17 December 2004 17:19
To: [log in to unmask]
Subject: [LCG-ROLLOUT] TORONTO-LCG2 down
An ssh worm attack within the physics subdomain has forced us to remove
access to the Toronto computing cluster. No estimate on the return at the
moment.
I'm also currently locked out of the GOCDB so cannot update the site status.
Apologies for the inconvenience.
Leslie Groer
,-~~-.___. __________________________________________
/ | ' \ [log in to unmask] Department of Physics
( ) 0 Tel: (416) 978-2959 University of Toronto
\_/-, ,----' Fax: (416) 978-8221 60 St. George St.
==== // Toronto, ON M5S 1A7
/ \-'~; /~~~(O) Canada
/ __/~| / | Office: McLennan Physics Lab Rm 911
=( _____| (_________| http://home.fnal.gov/~groer
Leslie S. Groer
|