[2084] in athena10
Traffic to physics.unc.edu blocked from VINEGAR-POT.MIT.EDU
daemon@ATHENA.MIT.EDU (The Linerva Team)
Mon Apr 6 13:16:06 2009
Date: Mon, 6 Apr 2009 13:15:32 -0400
From: The Linerva Team <linerva@MIT.EDU>
To: hostmaster@unc.edu
Message-ID: <20090406171532.GS5764@mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Hi,
I'm one of the maintainers of the host VINEGAR-POT.MIT.EDU (alias
LINERVA.MIT.EDU), which is a public login server offered to the MIT
community.
We have recently noticed that Linerva seems to be unable to access any
hosts under physics.unc.edu, as well as panic.edu; All traffic from
Linerva to those hosts seems to be silently dropped. Communication
from other machines on the same subnet as Linerva seems to be working
fine. Is PANIC blocking traffic from Linerva for some reason? If so,
may we request that the filter be removed?
If Linerva was being used as an attack platform against PANIC or
physics.unc.edu, or otherwise misbehaving, we would be interested to
hear about it so we can investigate and hopefully determine what
happened and prevent it from recurring. We are aware of one incident
in December where a compromised user used Linerva to launch ssh scans
of several networks, resulting in automated blocks from at least two
other universities.
(We originally sent this message to problem@physics.unc.edu, but it
was rejected by their mail server)
Thanks in advance,
- Nelson Elhage
for the Linerva maintainers
