Also - is this just about shell access, or also about access to dashboards?

This is about shell access only, and specifically to the various analytics 'stat' boxes that allow access to Hadoop or the MySQL research databases.

Besides that, there are quite a few surprising names on that list of WMF staff that I, as an "outsider", always assumed would have access to this kind of data

Yeah, I made this list only by familiarity. Many of these names I knew as well, but wasn't totally sure if they need continued access on the stat boxes. Often folks get access for a single project, and then never log in again, and we are trying to very slightly prune down the number of accounts.

Change 365971 had a related patch set uploaded (by Ottomata; owner: Ottomata):
[operations/puppet@production] Add expiry shell dates for 4 stat box users

https://gerrit.wikimedia.org/r/365971

Change 365971 merged by Ottomata:
[operations/puppet@production] Add expiry shell dates for 4 stat box users

https://gerrit.wikimedia.org/r/365971

I don't anticipate a need to use my access in the foreseeable future. You can remove my access and I'll ask for it back later should I need it.

@Ottomata: I went over the list and none of the formal collaborators I'm their point contact is on that list, and I myself am not. Thanks for the ping. I'm going to remove myself from this task at this point.

@DarTar You may want to set the expiration date of Ellery's access to the expiration date of his MOU to make sure the access is removed unless both sides agree to extend the MOU.

Thanks for starting this @Ottomata

Relevant to this thread I wanted to give you the heads up that @MoritzMuehlenhoff @RStallman-legalteam and I have started improving our internal tracking of NDAs/MOUs and server access. Hopefully we can consolidate the process so that Analytics, Ops, Legal, Research can all communicate via a centralized tool.

I can confirm that the following people from the list have signed NDAs that are on file with legal:

ellery
jdcc
goransm
jdittrich
moushirah

Like Guillaume: I don't anticipate a need to use my access in the foreseeable future. You can remove my access and I'll ask for it back later should I need it.

For the record, @ellery and @MoushiraEl / @Moushira sadly no longer work for WMF, although it's possible that they still require access as volunteers.

And are we certain that zhousquared belongs to @Zhouai and not @ZhouZ instead?

I can confirm zhousquared belongs to me.

I would like to keep my access (along with my deploy shell access), as I'm using it from time to time.

See also @daniel's comment above.

In the past life as an Android app dev I used EL quite regularly. Now in Reading Infrastructure I haven't had the need yet but it could be coming. Either way is fine with me for now. If access gets removed and I need it later, I'll ask for it.

Change 377446 had a related patch set uploaded (by Elukey; owner: Elukey):
[operations/puppet@production] Remove access to analytics posix groups for users not needing them.

https://gerrit.wikimedia.org/r/377446

Change 377446 merged by Elukey:
[operations/puppet@production] Remove access to analytics posix groups for users not needing them.

https://gerrit.wikimedia.org/r/377446

Remaining to check as far as I can see: @egalvezwmf, @cwdent, @dchen, @dduvall, @DFoy, @DStrine, @Etonkovidova, @JMinor, @JoeWalsh, @KartikMistry, @Mhurd, @ZhouZ

Sorry for the extra ping if you already answered, but could you please state if you need access to analytics stat hosts or not?

Thanks!

@elukey - at this point I do not need access, deactivate at will

Change 377472 had a related patch set uploaded (by Elukey; owner: Elukey):
[operations/puppet@production] admin::data.yaml: Set cwdent to ldap user only

https://gerrit.wikimedia.org/r/377472

Change 377472 merged by Elukey:
[operations/puppet@production] admin::data.yaml: Set cwdent to ldap user only

https://gerrit.wikimedia.org/r/377472

WMF staff, security team... Am I ok to keep access? :)

In T170878#3600768, @Reedy wrote:

WMF staff, security team... Am I ok to keep access? :)

I am not sure if I trust you but it should be ok :)

Thanks for updating the task!

@elukey: Let me know if you think this is something that will be completed on Q1 or rather we need to continue on Q2

In T170878#3601557, @Nuria wrote:

@elukey: Let me know if you think this is something that will be completed on Q1 or rather we need to continue on Q2

All the remaining users have a @wikimedia email and afaics they are staff members, so I think that the only action to take for some of them is maybe removing access if not needed anymore, but we can definitely do it in Q2 as low priority task without the need of a goal. The main important point, in my opinion, is to ensure that non WMF staff accounts have an expiration date and somebody in the WFM to contact in case of issues.

The main important point, in my opinion, is to ensure that non WMF staff accounts have an expiration date and somebody in the WFM to contact in case of issues.

And this is done, correct?

In T170878#3604545, @Nuria wrote:

The main important point, in my opinion, is to ensure that non WMF staff accounts have an expiration date and somebody in the WFM to contact in case of issues.

And this is done, correct?

All the users with shell access which are not WMF staff have a a contact address for quite a while now (half a year maybe?). Not necessarily an expiry address, since NDAs for volunteers are not time-limited per se.

In T170878#3605013, @MoritzMuehlenhoff wrote:

All the users with shell access which are not WMF staff have a a contact address for quite a while now (half a year maybe?). Not necessarily an expiry address, since NDAs for volunteers are not time-limited per se.

I think it's important to distinguish the NDA – which is not expiring by design, to make sure we have extended legal protection – vs any agreement that governs server access for non WMF staff. In the context of research collaborations, we're tying server access to the duration of the MOU. With @RStallman-legalteam we created a dedicated sheet in the NDA tracker. As soon as an MOU expires and a collaboration is archived, server access should be revoked.

I met with Rachel the other day and we decided to

• move the list of formal (MOU'ed) collaborations to the Foundation wiki (because they go beyond the Research team)
• explicitly add the start and expiry date of each collaboration in that table, since there's nothing sensitive about those dates

Sent an email to all the remaining users to verify their need of the accounts :)

Please keep access for me (chedasaurus). We use it for our quarterly metrics. Thanks!

WMF staff. Backup of @Amire80 So, you can keep my access. Thanks!

Please keep access for me as I use this for reviewing Zero traffic along with other country-level research for Global Reach / New Readers

I'd like to keep access without an expiration date for access to data from the mobile apps

I am a PM on the WMF staff and need continuing access to stats machines for product analysis.

I'd also like to keep access w/o expiration for apps data access.

Hi, I need continuing access to the stat boxes beyond the set expiration date (2018-01-01). I will be working with WMDE at least until 2018-09-30, mainly Wikidata analytics related things . @Tobi_WMDE_SW can confirm. Thanks a lot!

No answer from @dchen and @dduvall, but since they are WMF staff and they might be on vacation I am not inclined to remove their access. After a chat with my team we decided to keep their access since for the scope of this task it makes sense.

In T170878#3631676, @GoranSMilovanovic wrote:

Hi, I need continuing access to the stat boxes beyond the set expiration date (2018-01-01). I will be working with WMDE at least until 2018-09-30, mainly Wikidata analytics related things . @Tobi_WMDE_SW can confirm. Thanks a lot!

Hi Goran, you don't have an expiry date, the description is wrong, all good :)

Change 404743 had a related patch set uploaded (by Ottomata; owner: Ottomata):
[operations/puppet@production] Ensure samtar and samwalton9 are absent after account expiration

https://gerrit.wikimedia.org/r/404743

Change 404743 merged by Ottomata:
[operations/puppet@production] Ensure samtar and samwalton9 are absent after account expiration

https://gerrit.wikimedia.org/r/404743

FYI: @Samwalton9 and @Samtar, your access expired on 2018-01-01 and your accounts have been removed. Thanks! :)

(https://gerrit.wikimedia.org/r/#/c/404743/)