Backups were incomplete since March 17th. The tape robot couldn’t be used because a tapedrive failed, probably due to dry weather conditions. Therefore holding disks filled up. Only the backup of Tuesday upon Wednesday is possibly complete, but we lack backups of March 21st and 22nd, which is caused by a filesystem inconsistency of the holding disks, repairs already take two days. We’re trying hard to make backups this weekend, but please be cautious with your files, since restores of recently changed files might fail.

During the process of restoring the homedirectory of the affected user of the ransomware, the samba server was restarted, however it stopped, but not start. This was noticed only 45 minutes later. We have ajusted our monitoring to help us notice this more quickly.

Due to an accidental opening of an e-mail attachment (called Resume.doc), which contained a macro-based ransomware, all the files and directories on the mentioned shares were either removed or encrypted and a message was left on the infected computer to contact a certain URL to get the files back. The files were restored from backup and the PC wiped clean and re-installed. NB. The f-secure software did not recognise this malware yet at the time.

Yesterday morning, we got an alarm because the smtp service did not work properly. The cause was found to be that from various PCs from, among other countries, China, connections were built up with one of the smtp servers, without actually sending an e-mail, as a result of which all these connections were left hanging. If the number of standing connections became too high, the server became unusable for others. This service has to be be accessible from the Internet, because of authenticated SMTP. After a few PCs had been blocked, at 15:39 Fail2ban was turned on, that is also used to protect other services accessible from the Internet, such as mailservers, Linux loginservers, WWW-servers and GitLab servers.

This morning the fileserver reported a disc problem. To diagnose this, we have to upgrade the firmware, which makes downtime necessary. We planned this for next Monday morning because of the Next Business Day support contract. Sorry for any inconvenience. Affected disks: acfiles aerochem amsbackup amscommon animal astropresentie avance500 avance600 beevee b-fac-backup bioniccell bio-orgchem boltje carisma celbio1 celbio2 chemprac cncz coastoffon csgi-archief desda ds ehef1 ehef2 ehef3 ehef4 femtospin geminstr2 giphouse gissig global gmi goudsmit1 hfml-backup hfml-backup2 hfml-backup3 hfml-backup-inst highres imappdir imappsecr impuls introcie isis janvanhest kaartenbak kangoeroe khaj linova500 linova800 marcurkasco mathsolcie mbaudit1 mbscon mbsl molbiol mwstudiereis neuroinf neuroinf2 nfstest olympus puc randomwalkmodel ruversatest secres2 secrmolbiol sigma sigmacies spectra spectra-rw spm spmdata3 spmdata4 spmdata5 spmdata6 spmdata7 spmmagstm spmnanolab spmstaff ssi ssiguest staff-hfml stroom thalia thaliacies ucm vsc vsc1 vsc10 vsc11 vsc12 vsc13 vsc14 vsc15 vsc2 vsc3 vsc4 vsc5 vsc6 vsc7 vsc8 vsc9 vscadmin wiskalg wiskunde wkru

Because of a planned upgrade, gitlab.science.ru.nl and gitlab.pep.cs.ru.nl will not be available. See also: 1

The new certificate for the IMAP mailserver hadn’t been put into place correctly. Sorry for any inconvenience.

We placed an incorrectly packaged version on the install drive. After users reported this, the ISC has created a new package and we have replaced it.

New firmware will be loaded into the Heyendaal-East distribution router. During this period the wired and wireless network will be unavailable for approx. 30 minutes.

After an update of the samba software, it appears that the smbd service didn’t start up again. The problem was resolved by either rebooting (home1) or manually starting smbd (home2).