If sites use ban_user.db of LCAS on CE to stop the user's job
submission. The log of LCAS will show the user authZ failure, but there
is no further information about what job the user try to submit. And
also bear it in mind, even the user stop his activities, but the RB
might still try to re-submit this job to other sites untill it failed
permanently (up to the try level). In other word, there migth still be
some job activities, but these might not be submitted by the user after
he has been asked not to do so. But the user really should cancel the
job he has submitted instead of just stop submitting new jobs.
We need some direct evidence to show that the user still abused resource
even he has been told not to do so.
Regards,
Mingchao
> -----Original Message-----
> From: Testbed Support for GridPP member institutes
> [mailto:[log in to unmask]] On Behalf Of Alessandra Forti
> Sent: 07 November 2007 14:25
> To: [log in to unmask]
> Subject: Re: Heinz's RSA768 Job
>
> Hi Jens,
>
> if you had read this thread more carefully you would know
> that Oxford, Glasgow and Imperial had already replied to the
> request of looking for connections. And you perhaps have
> misread what I wrote I said that sites who have banned the
> user can only show connection attempts *NOT* what he was
> trying to do with those connections.
>
> Peter Love has unbanned him to understand what he was doing.
> Apparently they are attempts of old jobs still on the RB.
>
> cheers
> alessandra
>
> Jensen, J (Jens) wrote:
> > I thought you could see when a banned user tried to run a
> job? That's
> > why I asked if UK admins could check.
> >
> > I believe LCAS logs this if you ban users via LCAS. Only
> works for the CE though.
> >
> > It would be fairly dumb if you had to grant access to the
> user to see
> > if the user is still trying to run jobs.
> >
> > Cheers
> > --jens
> >
> >
> > -----Original Message-----
> > From: Testbed Support for GridPP member institutes on behalf of
> > Alessandra Forti
> > Sent: Wed 07/11/2007 13:39
> > To: [log in to unmask]
> > Subject: Re: Heinz's RSA768 Job
> >
> > Hi Jeremy,
> >
> > all sites have banned Heinz they can only show that he was
> trying to
> > submit jobs. The only site that might still have some evidence is
> > oxford becuase of the typo in the ban_users.db *if* we can get any
> > information from the RB ha has used whose IP should be in
> the oxford log files.
> >
> > cheers
> > alessandra
> >
> >
> > Coles, J (Jeremy) wrote:
> >> Hi Jens
> >>
> >>> But there *is* evidence that he is still trying to submit jobs, at
> >> least
> >>> from certain sites outside the UK.
> >> Yes understood. Romain writes to the OSCT ""Nikhef
> confirmed the user
> >> activity continued at least until yesterday 23:00 CET, so
> we should
> >> prepare to send some announcements to all sites."
> (Alessandra already
> >> mentioned NIKHEF).
> >>
> >> My question is still whether we have our own evidence (i.e. please
> >> send me something definitive) showing the work being
> submitted is the
> >> RSA factorisation. If not then I have nothing to work with
> since the
> >> VO only asked him to stop the RSA work and have not (yet)
> banned him.
> >>
> >> A list of issues related to trying to prevent further use
> would also
> >> be valuable in the follow up discussions.
> >>
> >> Jeremy
> >>
> >>> -----Original Message-----
> >>> From: Testbed Support for GridPP member institutes [mailto:TB-
> >>> [log in to unmask]] On Behalf Of Jensen, J (Jens)
> >>> Sent: 07 November 2007 13:21
> >>> To: [log in to unmask]
> >>> Subject: Re: Heinz's RSA768 Job
> >>>
> >>> But there *is* evidence that he is still trying to submit jobs, at
> >> least
> >>> from certain sites outside the UK.
> >>>
> >>> Can admins in the UK please check whether he's being rejected at
> >>> their gatekeeper (or wherever he is being blocked). Are
> there any
> >>> rejections from
> >> today?
> >>> Romain is also following up now with the biomed VO managers.
> >>>
> >>> Cheers
> >>> --jens
> >>>
> >>>
> >>> -----Original Message-----
> >>> From: Testbed Support for GridPP member institutes on behalf of
> >>> Coles,
> >> J
> >>> (Jeremy)
> >>> Sent: Wed 07/11/2007 13:17
> >>> To: [log in to unmask]
> >>> Subject: Re: Heinz's RSA768 Job
> >>>
> >>> Hi Jens/All
> >>>
> >>> Yes, but do we have direct evidence that he is still
> running the RSA
> >>> jobs and not relevant biomed work? If someone can provide that
> >> evidence
> >>> then I'm sure the VO will take further action. For now they asked
> >>> him
> >> to
> >>> stop and as I explained in a previous mail sites each
> need to decide
> >> if
> >>> they wish to support the user at all, or indeed the
> biomed VO given
> >> its
> >>> limited response.
> >>>
> >>> Jeremy
> >>>
> >>>
> >>>
> >>>> -----Original Message-----
> >>>> From: Testbed Support for GridPP member institutes [mailto:TB-
> >>>> [log in to unmask]] On Behalf Of Jensen, J (Jens)
> >>>> Sent: 07 November 2007 13:10
> >>>> To: [log in to unmask]
> >>>> Subject: Re: Heinz's RSA768 Job
> >>>>
> >>>> Biomed *must* kick him out if he persists in violating the VO's
> >> AUP!!
> >>>> Right?
> >>>>
> >>>> -j
> >>>>
> >>>>
> >>>> -----Original Message-----
> >>>> From: Testbed Support for GridPP member institutes on behalf of
> >>> Alessandra
> >>>> Forti
> >>>> Sent: Wed 07/11/2007 12:04
> >>>> To: [log in to unmask]
> >>>> Subject: Re: Heinz's RSA768 Job
> >>>>
> >>>> Biomed didn't kick him out it was left up to the sites.
> >>>>
> >>>> Jensen, J (Jens) wrote:
> >>>>> Apparently, Heinz has still been submitting jobs but
> possibly not
> >> to
> >>> the
> >>>> UK.
> >>>>> NIKHEF had found files created by Heinz up until 06 Nov. 22:00
> >>> (local).
> >>>>> Then they blocked his access to the SE.
> >>>>>
> >>>>> I had understood that he would stop submitting jobs and that
> >> biomed
> >>>> would
> >>>>> kick him out (quoth Johan) if he did.
> >>>>>
> >>>>> --jens
> >>>>>
> >>>>> -----Original Message-----
> >>>>> From: Ma, M (Mingchao) [mailto:[log in to unmask]]
> >>>>> Sent: Wed 07/11/2007 10:18
> >>>>> To: GridPP Dteam
> >>>>> Cc: Testbed Support for GridPP member institutes
> >>>>> Subject: Heinz's RSA768 Job
> >>>>>
> >>>>> Hi All,
> >>>>>
> >>>>> As I understood that Heinz has promised to stop submitting his
> >>> RSA768
> >>>>> job, could sites confirm or check that there are NO recent/new
> >>>>> activities? If you did see the job and therefore killed it, what
> >> the
> >>>>> last time you found it on your cluster? It seems that similar
> >>> activities
> >>>>> have been found at other ROCs (not UKI ROC) recently,
> but need to
> >> be
> >>>>> confirmed.
> >>>>>
> >>>>> Regards,
> >>>>>
> >>>>> Mingchao
> >>>>>
> >>>>> ------------------------------------------
> >>>>> Dr Mingchao Ma (MCSD CISSP)
> >>>>> Grid Security Officer
> >>>>> STFC e-Science Centre
> >>>>> Rutherford Appleton Laboratory
> >>>>> Chilton, Didcot, OX11 0QX, UK
> >>>>>
> >>>>> Email: [log in to unmask]
> >>>>> Tel: +44 (0) 1235 446515 (office)
> >>>>> ------------------------------------------
> >>>>>
> >>>>>
> >>>> --
> >>>> ***********************************
> >>>> * Alessandra Forti *
> >>>> * NorthGrid Technical Coordinator *
> >>>> * University of Manchester *
> >>>> ***********************************
> >
>
> --
> ***********************************
> * Alessandra Forti *
> * NorthGrid Technical Coordinator *
> * University of Manchester *
> ***********************************
>
|