Add notes for 2021-10-24

content/posts/2021-10.md

@@ -479,4 +479,47 @@ Time: 4417.909 ms (00:04.418)
   - We discussed several options, for example moving all DSpaces to CGSpace along with their permanent identifiers
   - The issue would be for centers like IFPRI who don't use DSpace and have integrations with their website etc with their current repository
 
+## 2021-10-21
+
+- Udana from IWMI contacted me to ask if I could do a one-off AReS harvest because they have some new items they need to report on
+
+## 2021-10-22
+
+- Abenet and others contacted me to say that the LDAP login was not working on CGSpace
+  - I checked with `ldapsearch` and it is indeed not working:
+
+```console
+$ ldapsearch -x -H ldaps://AZCGNEROOT3.CGIARAD.ORG:636/ -b "dc=cgiarad,dc=org" -D "booo" -W "(sAMAccountName=fuuu)"
+Enter LDAP Password:
+ldap_bind: Invalid credentials (49)
+        additional info: 80090308: LdapErr: DSID-0C090447, comment: AcceptSecurityContext error, data 52e, v3839
+```
+
+- I sent a message to ILRI ICT to ask them to check the account
+  - They reset the password so I ran all system updates and rebooted the server since users weren't able to log in anyways
+
+## 2021-10-24
+
+- CIP was asking about CGSpace stats again
+  - The last time I helped them with this was in 2021-04, when I extracted stats for their community from the DSpace Statistics API
+- In looking at the CIP stats request I got curious if there were any hits from all those Russian IPs before 2021-07 that I could purge
+  - Sure enough there were a few hundred IPs belonging to those ASNs:
+
+```console
+$ http 'localhost:8081/solr/statistics/select?q=time%3A2021-04*&fl=ip&wt=json&indent=true&facet=true&facet.field=ip&facet.limit=200000&facet.mincount=1' > /tmp/2021-04-ips.json
+# Ghetto way to extract the IPs using jq, but I can't figure out how only print them and not the facet counts, so I just use sed
+$ jq '.facet_counts.facet_fields.ip[]' /tmp/2021-04-ips.json | grep -E '^"' | sed -e 's/"//g' > /tmp/ips.txt
+$ ./ilri/resolve-addresses-geoip2.py -i /tmp/ips.txt -o /tmp/2021-04-ips.csv
+$ csvgrep -c asn -r '^(49453|46844|206485|62282|36352|35913|35624|8100)$' /tmp/2021-04-ips.csv | csvcut -c network | sed 1d | sort -u > /tmp/networks-to-block.txt
+$ wc -l /tmp/networks-to-block.txt 
+125 /tmp/networks-to-block.txt
+$ grepcidr -f /tmp/networks-to-block.txt /tmp/ips.txt > /tmp/ips-to-purge.txt
+$ wc -l /tmp/ips-to-purge.txt
+202
+```
+
+- Attempting to purge those only shows about 3,500 hits, but I will do it anyways
+  - Adding 64.39.108.48 from Qualys I get a total of 22631 hits purged
+- I also purged another 5306 hits after checking the IPv4 list from AbuseIPDB.com
+
 <!-- vim: set sw=2 ts=2: -->