grid-announce

grid-announce@nikhef.nl

48 discussions

Power outage affects selected services at Nikhef-ELPROD
by David Groep 04 Oct '08

04 Oct '08

Dear users of Nikhef (ELPROD), A major power outage in the Amsterdam (NL) area affected the compute services of Nikhef ELPROD. The worker nodes (but not storage or grid central services) are currently powered off and all running jobs were lost. It also affects the Dzero-specific LCG-RB, and the classic storage element (tbn15.nikhef.nl). The site currently publishes (correctly but somewhat uselessly) that it can run zero jobs, has zero free CPUs, and an almost infinite response time. Also the LHC-OPN link through SARA seems to be affected. All storage traffic is now routed through our public internet links, limiting bandwidth to at most 2 Gbps. We are in contact with the utility services to restore the site as soon as possible to full functionality. We are certain that the utility services will solve this issue as soon as possible. Again: no other services at ELPROD should be affected, ONLY the worker node compute servic e (gazon and trekker.nikhef.nl). Thank you for your consideration. David Groep. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

CE service at tbn20.nikhef.nl will be stopped
by Ronald Starink 20 Aug '08

20 Aug '08

The Computing Element service at host tbn20.nikhef.nl (grid site NIKHEF-ELPROD) will be stopped next week. - On Friday August 22 at 10:00, tbn20 will be removed from the information system. Then, new jobs cannot be submitted to tbn20 anymore, but already submitted jobs can still complete. - On Tuesday August 26 at 10:00, the CE service at tbn20 will be stopped. A replacing CE service is already operational at host gazon.nikhef.nl. The host alias ce03.nikhef.nl can still be used; it now points to gazon.nikhef.nl in Nikhef's DNS. Soon an additional CE will be installed on host trekker.nikhef.nl. An actual overview of active computing elements at Nikhef can always be obtained using the command: lcg-infosites --vo <YOUR-VO> ce | grep nikhef on a user interface machine. Please adjust your environment or scripts if you use hardcoded references to our CE tbn20.nikhef.nl. Regards, Ronald

1 0

stopping LFC service at eg.nikhef.nl
by Ronald Starink 13 Aug '08

13 Aug '08

The local file catalog (LFC) service at Nikhef, running at host eg.nikhef.nl, will be shut down this afternoon at 13:30. A replacing LFC service is already available for usage via the alias lfc03.nikhef.nl (physical host opkamer.nikhef.nl). If you are using the LFC at eg.nikhef.nl (as indicated by the environment variable LFC_HOST), please change the value of this variable to lfc03.nikhef.nl. Regards, Ronald

1 0

downtime for tbn18: Wed 13-Aug 11:15-12:15
by Ronald Starink 12 Aug '08

12 Aug '08

The DPM storage element tbn18.nikhef.nl will be unavailable for maintenance at: Wednesday August 13, 2008 11:15 - 12:15 During this period, file transfers from or to the storage element will not be possible. Regards, Ronald

1 0

[Fwd: OSCT Critical vulnerability alert: Debian OpenSSL predictable random number generator]
by David Groep 16 May '08

16 May '08

Dear all, FYI. Some of you may have Debian or Ubuntu based laptops or end-user systems. Those of you who have vulnerable X.509 certificates from the DutchGrid CA have been notified yesterday already to give you some leniency, but by now all vulnerable certificates have been revoked. If your certificate comes from another CA, you will be contacted today as well (or it will just implicitly be revoked). Note that the typical time needed to obtain all possible private keys is about 20 minutes (!) on a standard PC. By now, the list of private keys is a public non-secret. Please update and react as appropriate! Cheers, DavidG. -------- Original Message -------- Subject: OSCT Critical vulnerability alert: Debian OpenSSL predictable random number generator Date: Fri, 16 May 2008 17:59:38 +0200 From: Riccardo Brunetti <riccardo.brunetti(a)to.infn.it> To: <egee-broadcast(a)cern.ch> CC: OSCT <project-egee-osct(a)cern.ch>, <project-lcg-security-contacts(a)cern.ch> Dear EGEE site security contacts and site administrators. Please consider the following security alert, classified as extremely critical. --------------------------------------------------------------------------------- EGEE Operational Security Coordination Team security alert Critical vulnerability: Debian OpenSSL predictable random number generator Date: May 16th 2008 URL: http://cern.ch/osct/alerts/openssl-16-05-2008.txt Rating: extremely critical Affects: Debian systems and derivatives, including Ubuntu --------------------------------------------------------------------------------- A serious Debian (and derivatives, including Ubuntu) OpenSSL vulnerability (CVE-2008-0166) has been announced, related to a predictable random number generator in Debian's OpenSSL package: http://www.debian.org/security/2008/dsa-1571 As a consequence, all the cryptographic key material which has been generated by OpenSSL 0.9.8c-1 on affected systems is guessable and should be recreated after the OpenSSL security patch has been applied. The full list of affected credentials is available from the Debian advisory, but please note it includes SSH keys and X.509 certificates. Sites are strongly encouraged to follow-up on this issue, with a particular emphasis on Debian SSH servers and on systems where users would generate SSH key pairs or X.509 credentials, including grid User Interfaces or laptops. This vulnerability does not affect Red Hat systems or derivatives (ex: Scientific Linux). -- Key verification Additional information to deal with this vulnerability is available at: http://wiki.debian.org/SSLkeys Tools for checking SSH keys can be found at the following URLs: http://itsecurity.net/ http://metasploit.com/users/hdm/tools/debian-openssl/ http://security.ubuntu.com/ubuntu/pool/main/o/openssl-blacklist In addition, another tool has been prepared by Kent EngstrÃ¶m <kent(a)nsc.liu.se to check X.509 certificates. It can be found at the following URL: http://www.lysator.liu.se/~kent/ob/ -- Impact on Certificate Authorities Concerning X.509 host and personal certificates used in the grid environment, members of the IGTF are actively investigating the issue and affected users will be contacted as appropriate. The UKeScience Root certificate "UKeScienceRoot-2007" (98ef0ee5) that is distributed in the IGTF Trust Anchor versions 1.18, 1.19, and 1.20 is also affected by this issue. A new certificate with the same name (and thus the same) has has been generated based on new key material and is part of the updated release 1.21. For technical reasons, both the root and issuing CA certificate need to be replaced, although only the root certificate is affected by the vulnerability. As in a standard IGTF trust anchor installation, the subordinate issuing CA is also installed in the repository and this certificate is taken preferentially over any user-supplied version, the impact of this issue is somewhat limited. For software that honours the "signing_policy" or "namespaces" relying-party defined name space constraints policy, no end-entity certificates can easily be impersonated. Good fingerprints of the updated certificates are: $ openssl x509 -subject -fingerprint -sha1 -noout -in 98ef0ee5.0 subject= /C=UK/O=eScienceRoot/OU=Authority/CN=UK e-Science Root SHA1 = A1:39:B0:F3:04:6C:0B:F9:F5:0A:1B:33:00:06:4F:83:6B:7D:4F:3E $ openssl x509 -subject -fingerprint -sha1 -noout -in 367b75c3.0 subject= /C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science CA SHA1 = CA:1C:B6:6C:A9:E3:27:4D:F7:3E:A9:EB:6A:33:3F:C1:A2:B1:B8:D7 whereas the weak certificates are: subject= /C=UK/O=eScienceRoot/OU=Authority/CN=UK e-Science Root SHA1 = B1:77:5E:BB:11:13:B4:B5:0E:40:57:F1:E0:6A:BE:B9:4E:44:B7:45 subject= /C=UK/O=eScienceCA/OU=Authority/CN=UK e-Science CA SHA1 = 31:C1:93:3D:E8:9C:C4:B7:8A:02:B5:2D:56:D5:6B:43:56:0B:9F:CA There are no other CA certificates affected, although many CAs have vulnerable subscribers. Best Regards R.Brunetti (OSCT-DC) on behalf of OSCT group -- David Groep ** National Institute for Nuclear and High Energy Physics, PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

Service interruptions on Nikhef resource brokers
by David Groep 05 Feb '08

05 Feb '08

Dear users, Due to extremely high load on the Grid resource brokers ("RBs") and the top-level information services (BDII) at Nikhef, service and access to the RBs (rb03.nikhef.nl, and the hidden alternative "boszwijn.nikhef.nl") is currently reduced. You may experience sudden outages caused by system reboots as we are solving this issue. External (non-NL) access to the RBs has been curtailed in order to give a better response on the information system. DavidG. -- David Groep ** National Institute for Nuclear and High Energy Physics, PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

Downtime DPM storage element tbn18.nikhef.nl on Tue Jan 22 (09:00-17:00)
by Ronald Starink 15 Jan '08

15 Jan '08

On Tuesday January 22, the DPM server tbn18.nikhef.nl (dpm03.nikhef.nl) will be upgraded. The DPM grid storage system will therefore be unavailable between 09:00 and 17:00 local time. During the upgrade, it will not be possible to write data to the storage element nor to retrieve data from it. Regards, Ronald

1 0

Downtime NIKHEF-ELPROD for upgrade to el4/gLite3.1 on Wed Aug 15 10.00-10.30
by Ronald Starink 14 Aug '07

14 Aug '07

On Wednesday Aug 15, at 10.00 AM CEST all worker nodes in the NIKHEF-ELPROD site (NDPF) will be upgraded to CentOS4/gLite3.1. Jobs successfully submitted before 10.00 AM will be run on el3/gLite3.0, whereas jobs submitted after 10.30 AM CEST will be run on el4/gLite3.1. Information published in the CE's information system will reflect this platform choice. Selected queues will be drained appropriately to ensure no jobs are running beyond 10.00 AM CEST tomorrow. No submission will be possible in the scheduled downtime between 10.00 AM and 10.30 AM CEST. Additional downtime announcements: Storage services and brokering will be down for 15 min between 10.15 and 10.30 AM to allow for a kernel upgrade. Regards, Ronald

1 0

downtime for storage element tbn15.nikhef.nl
by Ronald Starink 19 Apr '07

19 Apr '07

Dear users, The classic storage element tbn15.nikhef.nl (also known as se03.nikhef.nl) will be unavailable on Friday March 20 2007, between 9:00 and 13:00 for maintenance. During the downtime, the files stored on this host will not be accessible, and new it will not be possible to write new files. Regards, Ronald

1 0

downtime user interface bosui.nikhef.nl
by Ronald Starink 11 Apr '07

11 Apr '07

Dear grid users, The user interface host bosui.nikhef.nl will be unavailable on Thursday April 12, 2007 between 10:00 and 15:00 for maintenance. Regards, Ronald

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

grid-announce