define in Puppet or remove user account - tnegrin
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	RobH
	Feb 26 2015, 9:00 PM

Description

Toby,

We're in the process of auditing and cleaning up our access lists to servers. During this audit, we found that your account is enabled on a one system, but not accounted for in our admins module.

stat1001.eqiad.wmnet

The statistics users have a few different levels of access in admins. If you could provide feedback on what exactly you are using this access for, and what permissions you need to maintain, we would appreciate it.

Please note feedback is required, as we'll be removing the access of anyone we don't account for during this audit.

Thanks in advance,

Details

	Subject	Repo	Branch	Lines +/-
	admin: remove access for tnegrin pt2	operations/puppet	production	+2 -2
	admin: remove access for tnegrin pt1	operations/puppet	production	+8 -9

Customize query in gerrit

Revisions and Commits

rOPUP Wikimedia Puppet
	rOPUP12582629b25e Add tnegrin to statistics-web-users
	rOPUPfca60a0b9eb3 Add tnegrin to statistics-web-users

Related Objects
Search...

Status	Assigned	Task
Resolved	• chasemp	T88826 Puppet should actively purge sudo and access rights not enumerated by the admins module
Resolved	• chasemp	T90923 Define in Puppet or remove rogue user accounts not currently defined in admin/data.yaml
Resolved	RobH	T90932 define in Puppet or remove user account - tnegrin

Event Timeline

RobH created this task.Feb 26 2015, 9:00 PM

RobH assigned this task to • Tnegrin.

RobH raised the priority of this task from to High.

RobH updated the task description. (Show Details)

RobH added projects: acl*security, acl*sre-team, SRE-Access-Requests.

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 26 2015, 9:00 PM

RobH mentioned this in T90923: Define in Puppet or remove rogue user accounts not currently defined in admin/data.yaml.Feb 27 2015, 6:19 PM

@Tnegrin ping

I need access to this system to run various queries against hadoop and
other databases. I do not need admin access.

thanks,

-Toby

https://gerrit.wikimedia.org/r/#/c/193848/

@mark could you approve this? Unsure who else to ask.

Dzahn reassigned this task from • Tnegrin to mark.Mar 5 2015, 6:16 PM

Dzahn subscribed.

As discussed during the operations meeting, @mark will need to comment on this task to approve getting toby's access set in puppet for these hosts.

When done, please set to assigned to nobody for triage to pick it up.

Toby's access to stat1001 is approved.

RobH claimed this task.Mar 10 2015, 3:39 PM

RobH added a commit: rOPUPfca60a0b9eb3: Add tnegrin to statistics-web-users.Mar 10 2015, 4:08 PM

I've merged live toby's corrected access to stat1001; resolving ticket.

• chasemp added a commit: rOPUP12582629b25e: Add tnegrin to statistics-web-users.Apr 28 2016, 3:22 AM

Restricted Application added a subscriber: Malyacko. · View Herald TranscriptApr 28 2016, 3:22 AM

Sorry Chase -- I don't actually need this now since I don't manage the
analytics team anymore. Probably best to remove the access.

thanks,

-Toby

@Tnegrin thanks for the update, reopened the ticket, we'll take care of it

Dzahn lowered the priority of this task from High to Medium.Apr 28 2016, 4:53 AM

@20after4 @chasemp @Tnegrin I think this notification about an old thing only happened right now because the releng team is importing git commits from gerrit into phabricator and it gets a timestamp from when phab imports it. nevertheless.. it's good to deactivate accounts that are not used and if we got notified this way, why not :p

it says "Still Importing...
This commit is still importing. Changes will be visible once the import finishes." on

https://phabricator.wikimedia.org/rOPUP12582629b25e628673917e50d9f52864cb3a4087

it was actually authored on March 2nd

Change 285898 had a related patch set uploaded (by Dzahn):
admin: remove access for tnegrin pt1

https://gerrit.wikimedia.org/r/285898

Change 285899 had a related patch set uploaded (by Dzahn):
admin: remove access for tnegrin pt2

https://gerrit.wikimedia.org/r/285899

@fgiunchedi ^ could you take a look? reverse access request

Dzahn added a subscriber: fgiunchedi.Apr 28 2016, 5:11 AM

@Tnegrin Just to make sure before i merge this, did you mean you don't need any shell access on WMF servers anymore or just not the access on the host stat1001 while still needing access to other servers?

I haven't logged into anything except my MacBook in months so I think
you're good to go!

Change 285898 merged by Dzahn:
admin: remove access for tnegrin pt1

https://gerrit.wikimedia.org/r/285898

Gotcha! .. and done

stat1001 - Notice: /Stage[main]/Ssh::Server/File[/etc/ssh/userkeys/tnegrin]/ensure: removed
bast1001 - Notice: /Stage[main]/Ssh::Server/File[/etc/ssh/userkeys/tnegrin]/ensure: removed

...

Change 285899 merged by Dzahn:
admin: remove access for tnegrin pt2

https://gerrit.wikimedia.org/r/285899

Dzahn closed this task as Resolved.Apr 29 2016, 2:57 PM

Dzahn mentioned this in rOPUP41b7812b6950: admin: remove access for tnegrin pt1.Jun 17 2016, 6:10 PM

Dzahn mentioned this in rOPUP13355bb3bbf0: admin: remove access for tnegrin pt1.

Dzahn mentioned this in rOPUP1e98a467a220: admin: remove access for tnegrin pt2.

• chasemp added a project: Security.Feb 10 2020, 10:59 PM

• chasemp removed a project: acl*security.Feb 20 2020, 8:18 PM