TGQR 2010Q4 Report.pdf - Teragridforum.org

8.8.4
PSC
During October, the PSC security team spent a significant amount of time responding to serious
Linux vulnerabilities that had been announced. These announcements were occurring about once
per week, and when announced, there were no vendor patches available. This created an awkward
situation where we had to find ways to protect against these threats until patches were made
available. For each of these vulnerabilities PSC’s Jim Marsteller created a wiki page so the status
of all production systems could be tracked. This included identifying which of the production
systems were at risk and what controls could be applied to mitigate the risks until an official
patch would be released. This same process was duplicated for TeraGrid in order to coordinate
responses from all resource providers. To date there have been no security incidents at PSC
related to these vulnerabilities.
PSC had no other security incidents during the quarter.
After conducting an audit for accounts that have not seen any activity in the past six months, PSC
disabled a number of inactive user accounts. We now have 1,200 fewer idle accounts for hackers
to target. There has only been one call from a user whose account was incorrectly disabled
(account was only used to access a Wiki maintained by PSC). We have modified our procedures
so that access to a wiki will be considered as active use of an account.
Jim Marsteller held the annual “Security 4 Lunch” on 08-Nov-2010 for all PSC staff and students.
The one hour presentation covered general information on security best practices including
material for PSC staff traveling to SC10. This year the staff was very interactive, asking a number
of security related questions. In fact, the VPN demo ran over the one hour allotted time.
8.8.5
Purdue disabled 11 TG accounts due to compromises reported at other RP sites. Purdue also
deleted SSH keys for one account due to compromise at another RP site. Purdue patched several
Linux kernel and libc 0-day vulnerabilities.
8.8.6
Purdue
SDSC
SDSC had five minor incidents this quarter. These incidents resulted in the compromise of
multiple user accounts elsewhere. Six user accounts were proactively suspended at SDSC as a
result. No evidence of abuse of these accounts was found prior to their deactivation.
SDSC performed and completed a security audit of Trestles. Minor configuration changes were
made to the system configuration to enhance security posture and improve the quality of
information available for incident detection and response.
8.8.7
TACC
A security compromise on the previous Lonestar system occurred on the two login nodes on
October 27, 2010. A then recent Linux kernel vulnerability was used by an intruder to gain root
privileges and replace ssh to collect user passwords. This tripped automatic change detection
scripts on Lonestar and notified admins of the compromise. TACC admins immediately cut off
access to Lonestar, notified TG security working group of compromised user account and began
forensic analysis of the compromise. During the investigation, the file used by the intruder to
start collecting passwords was found and had three user accounts in it, however, the intruder may
not have had time to retrieve those passwords once remote access was disabled. Those users
were immediately notified to change their passwords just in case of possible collection. A patch
was applied to the Lonestar kernel to remove the vulnerability.
In addition, three user accounts with compromises at other locations had their accounts disabled
on TACC systems.
85