Hi Alessandra.
I understood that Oxford, Glasgow, and IC (and Cambridge) had banned the user
(from accessing their CEs - which presumably uses LCAS so you can look for
connection attempts). But I think I did misread what you had written.
I understood from NIKHEF that there were still jobs running in the UK
which tried to access the NIKHEF SE. See separate mail.
-j
-----Original Message-----
From: Testbed Support for GridPP member institutes on behalf of Alessandra Forti
Sent: Wed 07/11/2007 14:25
To: [log in to unmask]
Subject: Re: Heinz's RSA768 Job
Hi Jens,
if you had read this thread more carefully you would know that Oxford,
Glasgow and Imperial had already replied to the request of looking for
connections. And you perhaps have misread what I wrote I said that sites
who have banned the user can only show connection attempts *NOT* what he
was trying to do with those connections.
Peter Love has unbanned him to understand what he was doing. Apparently
they are attempts of old jobs still on the RB.
cheers
alessandra
Jensen, J (Jens) wrote:
> I thought you could see when a banned user tried to run a job? That's why I asked
> if UK admins could check.
>
> I believe LCAS logs this if you ban users via LCAS. Only works for the CE though.
>
> It would be fairly dumb if you had to grant access to the user to see if the
> user is still trying to run jobs.
>
> Cheers
> --jens
>
>
> -----Original Message-----
> From: Testbed Support for GridPP member institutes on behalf of Alessandra Forti
> Sent: Wed 07/11/2007 13:39
> To: [log in to unmask]
> Subject: Re: Heinz's RSA768 Job
>
> Hi Jeremy,
>
> all sites have banned Heinz they can only show that he was trying to
> submit jobs. The only site that might still have some evidence is oxford
> becuase of the typo in the ban_users.db *if* we can get any information
> from the RB ha has used whose IP should be in the oxford log files.
>
> cheers
> alessandra
>
>
> Coles, J (Jeremy) wrote:
>> Hi Jens
>>
>>> But there *is* evidence that he is still trying to submit jobs, at
>> least
>>> from certain sites outside the UK.
>> Yes understood. Romain writes to the OSCT ""Nikhef confirmed the user
>> activity continued at least until yesterday 23:00 CET, so we should
>> prepare to send some announcements to all sites." (Alessandra already
>> mentioned NIKHEF).
>>
>> My question is still whether we have our own evidence (i.e. please send
>> me something definitive) showing the work being submitted is the RSA
>> factorisation. If not then I have nothing to work with since the VO only
>> asked him to stop the RSA work and have not (yet) banned him.
>>
>> A list of issues related to trying to prevent further use would also be
>> valuable in the follow up discussions.
>>
>> Jeremy
>>
>>> -----Original Message-----
>>> From: Testbed Support for GridPP member institutes [mailto:TB-
>>> [log in to unmask]] On Behalf Of Jensen, J (Jens)
>>> Sent: 07 November 2007 13:21
>>> To: [log in to unmask]
>>> Subject: Re: Heinz's RSA768 Job
>>>
>>> But there *is* evidence that he is still trying to submit jobs, at
>> least
>>> from certain sites outside the UK.
>>>
>>> Can admins in the UK please check whether he's being rejected at their
>>> gatekeeper
>>> (or wherever he is being blocked). Are there any rejections from
>> today?
>>> Romain is also following up now with the biomed VO managers.
>>>
>>> Cheers
>>> --jens
>>>
>>>
>>> -----Original Message-----
>>> From: Testbed Support for GridPP member institutes on behalf of Coles,
>> J
>>> (Jeremy)
>>> Sent: Wed 07/11/2007 13:17
>>> To: [log in to unmask]
>>> Subject: Re: Heinz's RSA768 Job
>>>
>>> Hi Jens/All
>>>
>>> Yes, but do we have direct evidence that he is still running the RSA
>>> jobs and not relevant biomed work? If someone can provide that
>> evidence
>>> then I'm sure the VO will take further action. For now they asked him
>> to
>>> stop and as I explained in a previous mail sites each need to decide
>> if
>>> they wish to support the user at all, or indeed the biomed VO given
>> its
>>> limited response.
>>>
>>> Jeremy
>>>
>>>
>>>
>>>> -----Original Message-----
>>>> From: Testbed Support for GridPP member institutes [mailto:TB-
>>>> [log in to unmask]] On Behalf Of Jensen, J (Jens)
>>>> Sent: 07 November 2007 13:10
>>>> To: [log in to unmask]
>>>> Subject: Re: Heinz's RSA768 Job
>>>>
>>>> Biomed *must* kick him out if he persists in violating the VO's
>> AUP!!
>>>> Right?
>>>>
>>>> -j
>>>>
>>>>
>>>> -----Original Message-----
>>>> From: Testbed Support for GridPP member institutes on behalf of
>>> Alessandra
>>>> Forti
>>>> Sent: Wed 07/11/2007 12:04
>>>> To: [log in to unmask]
>>>> Subject: Re: Heinz's RSA768 Job
>>>>
>>>> Biomed didn't kick him out it was left up to the sites.
>>>>
>>>> Jensen, J (Jens) wrote:
>>>>> Apparently, Heinz has still been submitting jobs but possibly not
>> to
>>> the
>>>> UK.
>>>>> NIKHEF had found files created by Heinz up until 06 Nov. 22:00
>>> (local).
>>>>> Then they blocked his access to the SE.
>>>>>
>>>>> I had understood that he would stop submitting jobs and that
>> biomed
>>>> would
>>>>> kick him out (quoth Johan) if he did.
>>>>>
>>>>> --jens
>>>>>
>>>>> -----Original Message-----
>>>>> From: Ma, M (Mingchao) [mailto:[log in to unmask]]
>>>>> Sent: Wed 07/11/2007 10:18
>>>>> To: GridPP Dteam
>>>>> Cc: Testbed Support for GridPP member institutes
>>>>> Subject: Heinz's RSA768 Job
>>>>>
>>>>> Hi All,
>>>>>
>>>>> As I understood that Heinz has promised to stop submitting his
>>> RSA768
>>>>> job, could sites confirm or check that there are NO recent/new
>>>>> activities? If you did see the job and therefore killed it, what
>> the
>>>>> last time you found it on your cluster? It seems that similar
>>> activities
>>>>> have been found at other ROCs (not UKI ROC) recently, but need to
>> be
>>>>> confirmed.
>>>>>
>>>>> Regards,
>>>>>
>>>>> Mingchao
>>>>>
>>>>> ------------------------------------------
>>>>> Dr Mingchao Ma (MCSD CISSP)
>>>>> Grid Security Officer
>>>>> STFC e-Science Centre
>>>>> Rutherford Appleton Laboratory
>>>>> Chilton, Didcot, OX11 0QX, UK
>>>>>
>>>>> Email: [log in to unmask]
>>>>> Tel: +44 (0) 1235 446515 (office)
>>>>> ------------------------------------------
>>>>>
>>>>>
>>>> --
>>>> ***********************************
>>>> * Alessandra Forti *
>>>> * NorthGrid Technical Coordinator *
>>>> * University of Manchester *
>>>> ***********************************
>
--
***********************************
* Alessandra Forti *
* NorthGrid Technical Coordinator *
* University of Manchester *
***********************************
|