It seems that @Jdouglas has the same ssh key in labs and in production. As this is in violation of the L3 document (and overall server responsibilities outlined on https://phabricator.wikimedia.org/T88464 ), & user has deployment access, we'll need to remove his production SSH key immediately.
@Jdouglas will need to update this task (via web) with a new production SSH public key (not used in any other labs or third party systems).
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Mark jdouglas as absent, remove from all groups. | operations/puppet | production | +8 -8 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | None | T108078 audit labs versus production ssh keys | |||
| Resolved | Andrew | T108111 Replace jdouglas's production ssh key - it matched labs key | |||
| Resolved | Andrew | T108203 Ops offboarding for jdouglas |
Assigning this to @Jdouglas so he can update with his ssh key. Additionally, I'm adding this to ops-access-requests, just so it gets triaged and his new key is pushed in immediately by anyone in ops who is around.
The old key's revocation is now live on the cluster. You'll find yourself unable to login. Once you update this task with your new key, please place this task up for grabs (assigned to no one). This ensures someone will pick it up (clinic duty or other opsen), rather than wait for a single ops person to fix it.
Note to other ops: He doesn't need to wait for the 3 day period, as this is simply replacing his key. Anyone in ops can create/merge the update immediately.
09:21 < mutante> is "jdouglas" around, maybe using a different nick?
09:21 < guillom> mutante: I think he left the WMF a couple of weeks ago.
09:24 < guillom> mutante: https://wikimediafoundation.org/w/index.php?diff=102858
so we don't have to re-enable any access it looks. re-assigning "for grabs" for him then.
09:43 < Krenair> guillom, mutante: They still have wiki accounts open and are in the wmf ldap group
09:44 < Krenair> if they have been offboarded it was not done properly
for the offboarding issue in general, also see T108131
Change 229755 had a related patch set uploaded (by Andrew Bogott):
Mark jdouglas as absent, remove from all groups.
Change 229755 merged by Andrew Bogott:
Mark jdouglas as absent, remove from all groups.