NDA request for Samtar
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	TheresNoTime
	Feb 2 2018, 7:01 PM

Description

Back in T174316 I was added to the nda LDAP group, but due to the expiry of T170878 it appears to have been removed.

I'm requesting to be re-added to the nda group so that I can continue to access Logstash and Graphite/Grafana

Details

	Subject	Repo	Branch	Lines +/-
	adding samtar to ldap users	operations/puppet	production	+4 -0

Customize query in gerrit

Related Objects

Mentioned Here: T157483: Request for access to stat1003 for Sam Tarling
T170878: Audit users and account expiry dates for stat boxes
T174316: NDA request for Samtar

Event Timeline

TheresNoTime created this task.Feb 2 2018, 7:01 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 2 2018, 7:01 PM

cc @RobH who previously dealt with T174316

So if your NDA with WMF legal has expired, you'll have to get a new one signed and on file with them for this request.

Has that already been done? (If not, this will have to be stalled until its done.) Please advise,

Edit Addition: I could be mistaken on the NDA expiring, and it may just be this has to be re-evaluated and re-granted. @MoritzMuehlenhoff is more aware of these policies, being in a more security aligned role.

RobH added a subscriber: MoritzMuehlenhoff.Feb 2 2018, 7:06 PM

@RobH per T157483#3026051 "..NDA doesn't actually have an expiry date", I'm not entirely sure it has expired (I just think my access to the stats server has). Happy however to re-sign/be re-evaluated if needs be!

@samtar: You are indeed correct, as far as I can tell your NDA has no expiry set (I have access to the WMF NDA google sheet that lists everyone who has one on file and any expiry.)

I think this just means we can extend you access again, but I'm not 100% certain. Unfortuantely, a LOT of the SRE (Ops) team are traveling or at Fosdem this week.

If I cannot find an answer for this today, it may have to wait for our ops meeting on Monday. I'll be able to sync up with @MoritzMuehlenhoff and ensure I'm not breaking any policies by just adding your access back.

No rush by any definition of the word :-)

RobH moved this task from Backlog to Manager Approval Pending on the LDAP-Access-Requests board.Feb 2 2018, 7:14 PM

herron triaged this task as Medium priority.Feb 5 2018, 2:47 PM

Ok, we chatted about this in the SRE meeting. It seems your shell account, and thus your ldap account, had rights revoked due to regular account auditing. It seems at that time a number of users were pinged via phabricator and had their accounts deactivated for non use.

No one has any objections to re-granting your ldap user the NDA flag, since your NDA is still on file and you are in good standing. I'll take care of it shortly.

Ops note: samtar's user is already in the shell user section, but listed as absented. I'm not entirely certain which will work, so I'll try adding him to the ldap users section first and see if it complains. Just FYI since they'll be patchsets linked into this task after this comment, which may or may not pass testing.

Change 408320 had a related patch set uploaded (by RobH; owner: RobH):
[operations/puppet@production] adding samtar to ldap users

https://gerrit.wikimedia.org/r/408320

Change 408320 merged by RobH:
[operations/puppet@production] adding samtar to ldap users