From: Christian Holm Christensen (cholm@hehi03.nbi.dk)
Date: Wed Jan 08 2003 - 17:37:50 EST
Hi Djam et al, Djamel Ouerdane <ouerdane@nbi.dk> wrote concerning bramreco [Wed, 8 Jan 2003 22:36:38 +0100 (CET)] ---------------------------------------------------------------------- > Hi, > > ... (Peter can confirm, he saw the histograms). Didn't I see it too? > But someone decided that it was not good and deleted it _without any > warning_. Whoa, not good. I really nifty little trick to figure out who's doing what, is to do > last | head cholm pts/12 lxplus6.plus.cer Wed Jan 8 23:11 still logged in cholm pts/11 130.199.6.104 Wed Jan 8 23:10 still logged in cholm pts/10 130.199.200.64 Wed Jan 8 23:09 still logged in cholm pts/9 :0 Wed Jan 8 23:09 still logged in cholm pts/9 130.199.200.64 Wed Jan 8 23:08 - 23:08 (00:00) cholm pts/8 :0 Wed Jan 8 23:08 still logged in cholm pts/7 lscf.nbi.dk Wed Jan 8 23:07 still logged in cholm pts/6 :0 Wed Jan 8 23:07 still logged in cholm pts/5 :0 Wed Jan 8 23:07 still logged in cholm pts/4 :0 Wed Jan 8 16:20 still logged in [that's from my local machine at NBI, so ...] on `rcrsuser', and see where the `bramreco' user is logged in from, and when. Most people that use `bramreco' has a tendency to stay logged on until their jobs finishes (why?). Now, having figured out the gateway used, open up another term and ssh directly to that gateway. Then on the gateway, grep for anyone that logged in around the time `bramreco' logged into `rcrsuser' > last | grep "Wed Jan 8 23:1" cholm pts/12 lxplus6.plus.cer Wed Jan 8 23:11 still logged in cholm pts/11 130.199.6.104 Wed Jan 8 23:10 still logged in Now that should give you a good idea of who's coming from where, and what they're doing. If you get an IP-number, you can use host to look up the name: > host 130.199.6.104 Host 104.6.199.130.in-addr.arpa not found: 3(NXDOMAIN) [OK, it doesn't always work. 130.199.6.104 is `rcrsuser1', and 130.199.200.64 is `rcas0014'] Anyway, you have a reasonable chance of flaming the right person (Asbestos-suits ON everybody). Now, that's a lot of work to do when it could be solved much simpler: By using LSF/PBS as the farm software on CRS! Both to proper accounting, and ladida. The other lesson is, that on the internet, you're never truely anonymous, so if anyone thinks they can hide behind a `bramreco' login - think again! Only really _really_ good cracker nows how to hide away completely, and I don't think BNL/CIA/FBI/DoE/DoHS would be very happy about it if you tried to! In fact, the guy who did the infamous `Internet-Worm of 1988' got caught in the end (some say it's because he was stupid :-) > ... SEND A SHORT NOTICE!!!!!! Back in the golden days when there was only a handful of people with access to `bramreco' (I believe it was Eun-Joo, Flemming, Kris, Ian, Steve, and myself) I tried to start the protocol of always sending out a message to the others, informing them that I was about to reduce a certain run, so that they wouldn't start similar jobs. Perhaps not such a bad idea. > I don't want to use rude words or speak too bad but ... but, but ... YOU ARE SHOUTING (my ears hurt :-) > PS: again, to the person using masterReduction.sh, please, DO NOT > put your special setting directly in the script but USE THE COMMAND > OPTIONS! or make a copy of this script and call it whatever you want > and modify this copy as you like. Ah, another reason for using LSF/PBS on the CRS farm - you don't get to screw it up for anyone else, as you're running in your user-land (taking a bit of BSD-lingo a bit to far :-) BTW, why isn't `masterReduction.sh' in BRAT/CRASH or something? Maybe called `brapster' (ill-disguised reference to ...?) If it's for production, it _must_ be in a CVS package. Yours, ___ | Christian Holm Christensen |_| | ------------------------------------------------------------- | | Address: Sankt Hansgade 23, 1. th. Phone: (+45) 35 35 96 91 _| DK-2200 Copenhagen N Cell: (+45) 24 61 85 91 _| Denmark Office: (+45) 353 25 305 ____| Email: cholm@nbi.dk Web: www.nbi.dk/~cholm | |
This archive was generated by hypermail 2.1.5 : Wed Jan 08 2003 - 17:40:29 EST