According to my script, both @Mvolz and @Jdouglas have labs keys in production.

Whoops. You can revoke that key, I haven't needed production access in a
while. https://gerrit.wikimedia.org/r/190405 was the change.

Change 229562 had a related patch set uploaded (by Dzahn):
admin: deactivate shell for user mvolz

https://gerrit.wikimedia.org/r/229562

Per request, here's the script. Stick it in modules/ldap/files/scripts (operations/puppet clone) on a machine which is connected to labs LDAP, and run it from that directory.

import ldapsupportlib, ldap, yaml

ldapSupportLib = ldapsupportlib.LDAPSupportLib()
ds = ldapSupportLib.connect()
base = "ou=people," + ldapSupportLib.getBase()

keys = set()
for entry in ds.search_s(base, ldap.SCOPE_SUBTREE, "(objectclass=inetOrgPerson)"):
    for k, v in entry[1].items():
        if k == "sshPublicKey":
            for v2 in v:
                key = ' '.join(v2.split(' ')[:2])
                keys.update([key])

prodData = yaml.load(open('../../../admin/data/data.yaml'))
for userName, userData in prodData['users'].items():
    badKeys = list(set(userData['ssh_keys']).intersection(keys))
    if len(badKeys) > 0:
        print userName, badKeys

ds.unbind()

Change 229562 abandoned by Dzahn:
admin: deactivate shell for user mvolz

https://gerrit.wikimedia.org/r/229562

@RobH: Any reason for this to remain open?

@RobH: Do you think we should turn this into some sort of regular check? Not sure icinga necessarily would be appropriate, but...

@Krenair I think in a perfect world it would be detected by jenkins. If somebody touches a file in admin and there is a key in it it would have to compare it to all existing labs keys though and vote -1 if it finds a match. How unrealistic is that?

In T108078#1618923, @Dzahn wrote:

@Krenair I think in a perfect world it would be detected by jenkins. If somebody touches a file in admin and there is a key in it it would have to compare it to all existing labs keys though and vote -1 if it finds a match. How unrealistic is that?

That would be an annoying check to have fail when trying to do something completely separate. Good idea for new keys being added, but a production key can be added as a labs one at any time.

That said, I think jenkins might be less annoying in operations/puppet than it is where I'm used to it - i.e. VE-MW (where you can't merge anything without either being jenkins or l10n-bot.)

Looks like https://gerrit.wikimedia.org/r/#/c/175442/ did something like this

maybe we can get this merged and ask CI team to add it as a non-voting check on operations/puppet and see how it works. then if we like it , just change non-voting to voting

We are all agreed that jenkins failing on this would be pretty annoying, since it could block unrelated changes. BUT surely we can do some sort of regular audit.

Yes. Let's open a separate task (maybe a subtask of T142815) for that?