sync: auto-sync from HOWARD-HOME at 2026-04-21 15:07:39
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-04-21 15:07:39
This commit is contained in:
@@ -0,0 +1,82 @@
|
||||
# Cascades Tucson — Post-DMARC spoofing recheck + yq install (Howard)
|
||||
|
||||
## User
|
||||
- **User:** Howard Enos (howard)
|
||||
- **Machine:** Howard-Home
|
||||
- **Role:** tech
|
||||
|
||||
## Session
|
||||
- **Date:** 2026-04-21 (UTC)
|
||||
- **Scope:** Verify tooling health on Howard-Home, verify Mike's DMARC fix is working for Cascades, clean up two missed phishes, then hand off for Intune Phase B-1
|
||||
|
||||
---
|
||||
|
||||
## Note for Mike
|
||||
|
||||
### Good news
|
||||
Your `_dmarc.cascadestucson.com` change from `p=none` to `p=quarantine; pct=100` is working. Between your 16:34Z sweep yesterday and 20:22Z today, **zero new signature-matching spoofs were delivered**. Two phishes landed after your sweep but before DNS propagation (both show `dmarc=fail action=none` in their headers — DMARC was still observational at delivery). Since the change propagated: nothing. 26-hour clean window.
|
||||
|
||||
### Two stragglers I cleaned up
|
||||
Your 4/20 sweep targeted 7 mailboxes; these two weren't on that list but got hit with same-campaign messages you'd have deleted if you'd seen them:
|
||||
|
||||
| Mailbox | When (UTC) | Subject | Origin | Outcome |
|
||||
|---|---|---|---|---|
|
||||
| `accounting@` | 4/20 13:41Z | Action Required: Service Termination Alert | 104.168.70.29 (ColoCrossing US, `LANG:zh-cn`) | **Permanently deleted** from Inbox, HTTP 204 |
|
||||
| `jd.martin@` | 4/20 18:28Z | NSA: Cascadestucson Executed NDA Agreement | 178.211.155.48 (Deltahost DE, `LANG:en`) | **Permanently deleted** from Deleted Items, HTTP 204 |
|
||||
|
||||
Both were envelope-spoofed as the recipient themselves, both credential/document-bait phishes from the same operator as yesterday (new IPs but same hoster patterns — ColoCrossing + Deltahost). JD's was already user-deleted before I got to it; accounting@ was still in the Inbox.
|
||||
|
||||
### User advisory — please mention when you talk to them
|
||||
- **accounting@** (whoever checks that shared mailbox — likely Mary Hogan-Padilla): "On 4/20 around 6:41 AM local you got a fake Microsoft password-expiry email. Did anyone click the link? Need to know so we can decide whether to reset creds."
|
||||
- **JD Martin**: "The DocuSign/NDA email on 4/20 at 11:28 AM local was a phish. Confirm you didn't click through or enter any credentials."
|
||||
|
||||
### IP blocking — skipped
|
||||
You recommended TABL additions for the 4 IPs yesterday. I added the two new IPs (104.168.70.29, 178.211.155.48) to my report but **did NOT add them to TABL** — since DMARC enforcement is working, the additive blocks are redundant. If we see another wave that slips past DMARC, that's the signal to add them.
|
||||
|
||||
### DMARC aggregate reports
|
||||
Still routing to `info@cascadestucson.com` (internal mailbox, no one parsing). Flagged in my morning spoofing-hunt report as the highest-leverage remaining fix. I didn't touch this. Consider pointing `rua` at dmarcian or EasyDMARC (free tiers) so we can see who's spoofing cascadestucson.com in the wild + confirm enforcement empirically.
|
||||
|
||||
### `p=reject` readiness
|
||||
Once we have a week of aggregator data showing no legit senders are quarantined in error, you can bump from `p=quarantine` to `p=reject`. Don't do this blind — the risk is silently breaking a forwarding chain or vendor mail. Aggregator-first, then escalate.
|
||||
|
||||
---
|
||||
|
||||
## Tooling fixes this session
|
||||
|
||||
### Howard-Home state at start
|
||||
- Ollama local: running (qwen3-coder:30b, nomic-embed-text)
|
||||
- Ollama Tailscale: running (codestral:22b, qwen3:14b)
|
||||
- GrepAI watcher: running, indexed 1,978 files / 13,473 chunks / 85.3 MB, steady
|
||||
- Vault: `D:/vault` present, sops binary present, age keys present
|
||||
|
||||
### Problem found: `vault.sh` broken because `yq` missing
|
||||
`bash D:/vault/scripts/vault.sh get-field ...` was emitting:
|
||||
```
|
||||
[ERROR] Neither yq nor Python is available for YAML parsing.
|
||||
Install yq or ensure python + yaml-query.py are present.
|
||||
```
|
||||
|
||||
`vault.sh` looks for `yq` first, then a Python fallback via `$SCRIPT_DIR/yaml-query.py`. Neither existed on Howard-Home.
|
||||
|
||||
### Fix applied: installed yq v4.53.2 via winget
|
||||
```
|
||||
winget install MikeFarah.yq
|
||||
```
|
||||
Installed to `C:\Users\Howard\AppData\Local\Microsoft\WinGet\Links\yq.exe`. Verified: `vault.sh get-field` now returns clean values.
|
||||
|
||||
### Gap: Python fallback script still missing everywhere
|
||||
`vault.sh:17,39,49` references `$SCRIPT_DIR/yaml-query.py` but that file doesn't exist in `D:/vault/scripts/` (or anywhere in the vault repo). The fallback path Mike coded for (WDAC / policy-restricted machines) is documented but missing its implementation. Not urgent since yq works on Howard-Home and presumably on DESKTOP-0O8A1RL, but worth committing a `yaml-query.py` helper so the fallback actually fires if yq is blocked on a future machine.
|
||||
|
||||
---
|
||||
|
||||
## Also done this session
|
||||
- `/sync` at session start — pulled 4 commits from Mike (MacBook-Air): Syncro API corrections, GuruRMM MSI deploy fix, BirthBiologic onboarding, desertrat.com Mailprotector SBR repair. Nothing Cascades-related.
|
||||
- Report written: `reports/2026-04-21-post-dmarc-spoofing-recheck.md` (full methodology + headers + delete log)
|
||||
- Sweep script kept at `C:/tmp-scripts/cascades_scan.sh` for future rechecks (reusable against any domain with `cascadestucson.com` → variable)
|
||||
|
||||
## Data artifacts
|
||||
- `/tmp/cascades_recheck/` — users list, hits.jsonl, per-hit headers, delete log
|
||||
- `/tmp/cascades_recheck/delete_log/20260421T203252Z_deletions.jsonl` — structured record of the 2 HTTP 204 permanentDelete calls
|
||||
|
||||
## What's next (picking up from 4/20 session)
|
||||
**Intune Phase B-1: Android compliance policy.** See `docs/intune-b1-android-compliance-walkthrough.md` (new this session). Howard-Home executes via admin center this session.
|
||||
Reference in New Issue
Block a user