• Read and sign https://phabricator.wikimedia.org/L3 ✓
• Sign up for a wikitech account ✓

piccardi

• Append public ssh key to this phabricator task

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAozlVbJ2Cmn3TrZvHChyiHShcWIERWVtl0A+V/w2P5jrpq4WGe2qx/DMPkUDsS5AvhOwY2b9qtAGbx/M+26+b0+xkJihrnT9Fy/IwEDxBFRtcIZ0N1ZvRlK2epb12gfX3oTfQWiSJcmlZOhJCS/GUfeZAAvJiDifnyWeaJAYlkPxPaWVhbF0Xv/W+3zQTQYfPuQEp1S6IKecN3bvW0/8t8fANzbfIjRtwBTSfZiKtHNZwnphaVAPF+xF7wV36spPeRbrxaB6Xy/3pEU00uT7qvyoDpB511w6IVIQfhiAVROVfCbTwyrPtuP+BZHRGFGE7hyo8pFQDQUnEU0yM11NYdQ==

• What is his preferred login name?

piccardi

Thanks

Thanks, @tizianopiccardi . :)

@Nuria we need your approval to give Tiziano access to the cluster. If you need any information from me, please let me know. The access is requested since for the article/stub expansion recommendation research we need computation power provided in the cluster as well as access to logs for building a measure of importance for ranking articles to be expanded.

What is the project this access is linked to?

@Nuria this request is related to the proposal for building a recommendation system for expanding articles/stubs across languages: https://meta.wikimedia.org/wiki/Research:Expanding_Wikipedia_stubs_across_languages

Approved on my end. Please remember to open ticket to revoke access when project is done.

@Cmjohnson same comment as in T152023#2855353.

Change 325869 had a related patch set uploaded (by RobH):
new shell user piccardi

https://gerrit.wikimedia.org/r/325869

Please note that there are a couple things that'll make future requests easier:

• tag with SRE-Access-Requests, full details can be viewed on getting help from operations.
• the ops clinic duty assignee for the week handles and process all access requests, this changes weekly, so please avoid assigning or requesting access requests from a specific person.
• if you are ready for ops to take it over, please ensure it isnt assigned to anyone awaiting input, this way clinic duty takes it over.

Since the NDA process is a bit different for different departments, I'm not sure where to verify NDA status. I don't see a signature on the NDA form in phabricator (L2.) Please advise on this @leila. (I also don't see him on the staff contact page, since all staff paperwork has NDA included that would suffice.)

I've created this patchset for the access request: https://gerrit.wikimedia.org/r/#/c/325869/

Once the NDA info has been added, and a full 3 business day wait has passed, its approved from Ops. Since this only got tagged with the ops-access-request today, the 3 day wait starts now. (Any days before adding the tag don't allow any kind of oversight.)

In T151969#2856231, @RobH wrote:

Please note that there are a couple things that'll make future requests easier:

• tag with SRE-Access-Requests, full details can be viewed on getting help from operations.
• the ops clinic duty assignee for the week handles and process all access requests, this changes weekly, so please avoid assigning or requesting access requests from a specific person.
• if you are ready for ops to take it over, please ensure it isnt assigned to anyone awaiting input, this way clinic duty takes it over.

Thanks for explaining the process. :)

Since the NDA process is a bit different for different departments, I'm not sure where to verify NDA status. I don't see a signature on the NDA form in phabricator (L2.) Please advise on this @leila. (I also don't see him on the staff contact page, since all staff paperwork has NDA included that would suffice.)

The two researchers are formal collaborators, non-staff. The task that captures the NDA and MOU signatures is T148546 and the corresponding comment from Legal is T148546#2831609 . Does this help?

Change 325869 merged by RobH:
new shell user piccardi

https://gerrit.wikimedia.org/r/325869

Re-opening this, as @tizianopiccardi has accidentally deleted his private key. He has generated a new key pair. He will post it below. @RobH could you please update tiziano's key on the system? Thanks!

Hi all, this is my new public key. You can revoke the old one. Thank you!

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/gM+ET26j1I16ZWjbbcoWQhMNYj3AlS0yZQCSnLKbv6pbGCOs9xtTsxQQLH71ITdrlvS9E7KTjR4Ycn/gbgprkrtxCT89U4kU41kQTDHfAow8zodB7S99B0NR2cfUzAVglzw28mDfiCnlk7RS761Zgw+vJhrvGIwwwQngDXR7Y3PN8I3n6h4Jvv3Sm+NvWZD2j/OzeGWZF6XE60sRxXR9IriEjSpETqTwrAk6l0PhrJgzccfEtFWWcLy+ueSrSjL7TF6rxG663C8WA3F2NGm3GTGJCwxGyH94urPOoHZ/Xfqwa3vt6al8DLNpgVziUPnARXN0DsNsT0bUV2MIhRm1b0vapWUySFHr4yyGYjoMzB4WWqQZXeswJr4LYhf2j8RRhjacKp4ucKwbNO/ytwXzwvAGXXxgA+RGqxcKp6wwGVyZNDS0kRyI23xlaIM7N9nJxsK+q9n7uTDeeR+beUxmqoRg0x4pt8nNI2C+NnNL0vKdZtPtHBhunIN2ARycBm8Q8oEfOq/eA7RDw+srPFCaadG0z9jQ0qJB69RHCVZZohCHv7Jryz+iHTdiRcAPqUBCB9MwcpzqkWUirdpSQR1kz0qJpGN3BWxU6VlDpBpMRnjByTcAigVPfei2fOzAH3P7k1yE9eoT7ooyU+RtLreYbtCODpp03sTwRTOzvbjWiQ== tiziano.piccardi@epfl.ch

Change 444162 had a related patch set uploaded (by Alexandros Kosiaris; owner: Alexandros Kosiaris):
[operations/puppet@production] user piccardi ssh key update

https://gerrit.wikimedia.org/r/444162

Change 444162 merged by Alexandros Kosiaris:
[operations/puppet@production] user piccardi ssh key update

https://gerrit.wikimedia.org/r/444162

Thanks @akosiaris !!

Change 564747 had a related patch set uploaded (by Elukey; owner: Elukey):
[operations/puppet@production] admin: update user piccardi's ssh public key

https://gerrit.wikimedia.org/r/564747

hi @tizianopiccardi i can confirm your user exists on bast1002 and notebook1003 and your key has not been revoked. It is:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/gM+ET26j1I16ZWjbbcoWQhMNYj3AlS0yZQCSnLKbv6pbGCOs9xtTsxQQLH71ITdrlvS9E7KTjR4Ycn/gbgprkrtxCT89U4kU41kQTDHfAow8zodB7S99B0NR2cfUzAVglzw28mDfiCnlk7RS761Zgw+vJhrvGIwwwQngDXR7Y3PN8I3n6h4Jvv3Sm+NvWZD2j/OzeGWZF6XE60sRxXR9IriEjSpETqTwrAk6l0PhrJgzccfEtFWWcLy+ueSrSjL7TF6rxG663C8WA3F2NGm3GTGJCwxGyH94urPOoHZ/Xfqwa3vt6al8DLNpgVziUPnARXN0DsNsT0bUV2MIhRm1b0vapWUySFHr4yyGYjoMzB4WWqQZXeswJr4LYhf2j8RRhjacKp4ucKwbNO/ytwXzwvAGXXxgA+RGqxcKp6wwGVyZNDS0kRyI23xlaIM7N9nJxsK+q9n7uTDeeR+beUxmqoRg0x4pt8nNI2C+NnNL0vKdZtPtHBhunIN2ARycBm8Q8oEfOq/eA7RDw+srPFCaadG0z9jQ0qJB69RHCVZZohCHv7Jryz+iHTdiRcAPqUBCB9MwcpzqkWUirdpSQR1kz0qJpGN3BWxU6VlDpBpMRnjByTcAigVPfei2fOzAH3P7k1yE9eoT7ooyU+RtLreYbtCODpp03sTwRTOzvbjWiQ==

and that matches what is in the repository and on disk.

Are you sure that's the one you are currently trying to use? Could you maybe paste your .ssh/config file?

I see the SHA256 of the public key you are attempting to use is:

SHA256:wNTUKNPfq5Wyubriy6VGxmqrPq3m9l6GSiyF0SV/ywE

but the SHA256 of the public key you have in the repo and on disk is:

SHA256:aw4jMdpq+mw0hkDDlqx+rJ6+qVHDj7UL7d9wyr+KXVg

So that looks like your config has a different key in it or you have multiple keys loaded in ssh-agent.

If you run "ssh-keygen -lf <filename>" on your keys and it matches the hash above then it should be the correct one. Maybe you can verify that and make sure all other keys are unloaded.

Hi Daniel,

yes, I'm quite sure I didn't change anything (unless OSX updated and changed files somewhere). Here a full log:

> cat ~/.ssh/config

Host *
    UseRoaming no

Host *
  ServerAliveInterval 60

### Short names
#Host <some host you want your system to auto-complete>

## Use bastion-eqiad.wmflabs.org as proxy to labs
Host bastlabs
HostName bastion-eqiad.wmflabs.org
User piccardi

Host *.eqiad.wmflabs !bastion-eqiad.wmflabs.org
User piccardi
IdentityFile ~/.ssh/wikipedia
ProxyCommand ssh -a -W %h:%p bastlabs

## production
Host bastproduction
HostName bast1002.wikimedia.org
User piccardi
#for accessing mysql locally
LocalForward 8889 analytics1027.eqiad.wmnet:8888
LocalForward 8001 analytics-store.eqiad.wmnet:3306
LocalForward 8002 s1-analytics-slave.eqiad.wmnet:3306

Host *.eqiad.wmnet *.wikimedia.org !bastproduction
User piccardi
IdentityFile ~/.ssh/wikipedia
ProxyCommand ssh -a -W %h:%p bastproduction

Host tools-dev.wmflabs.org
User piccardi
IdentityFile ~/.ssh/wikipedia

> cat /etc/ssh/ssh_config

# <comments omitted>

Host *
	SendEnv LANG LC_*

> cat ~/.ssh/wikipedia.pub

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/gM+ET26j1I16ZWjbbcoWQhMNYj3AlS0yZQCSnLKbv6pbGCOs9xtTsxQQLH71ITdrlvS9E7KTjR4Ycn/gbgprkrtxCT89U4kU41kQTDHfAow8zodB7S99B0NR2cfUzAVglzw28mDfiCnlk7RS761Zgw+vJhrvGIwwwQngDXR7Y3PN8I3n6h4Jvv3Sm+NvWZD2j/OzeGWZF6XE60sRxXR9IriEjSpETqTwrAk6l0PhrJgzccfEtFWWcLy+ueSrSjL7TF6rxG663C8WA3F2NGm3GTGJCwxGyH94urPOoHZ/Xfqwa3vt6al8DLNpgVziUPnARXN0DsNsT0bUV2MIhRm1b0vapWUySFHr4yyGYjoMzB4WWqQZXeswJr4LYhf2j8RRhjacKp4ucKwbNO/ytwXzwvAGXXxgA+RGqxcKp6wwGVyZNDS0kRyI23xlaIM7N9nJxsK+q9n7uTDeeR+beUxmqoRg0x4pt8nNI2C+NnNL0vKdZtPtHBhunIN2ARycBm8Q8oEfOq/eA7RDw+srPFCaadG0z9jQ0qJB69RHCVZZohCHv7Jryz+iHTdiRcAPqUBCB9MwcpzqkWUirdpSQR1kz0qJpGN3BWxU6VlDpBpMRnjByTcAigVPfei2fOzAH3P7k1yE9eoT7ooyU+RtLreYbtCODpp03sTwRTOzvbjWiQ== tiziano.piccardi@epfl.ch

> ssh -vvv notebook1003.eqiad.wmnet

OpenSSH_7.9p1, LibreSSL 2.7.3
debug1: Reading configuration data /Users/tiziano/.ssh/config
debug1: /Users/tiziano/.ssh/config line 1: Applying options for *
debug1: /Users/tiziano/.ssh/config line 2: Deprecated option "useroaming"
debug1: /Users/tiziano/.ssh/config line 4: Applying options for *
debug1: /Users/tiziano/.ssh/config line 29: Applying options for *.eqiad.wmnet
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug1: Executing proxy command: exec ssh -a -W notebook1003.eqiad.wmnet:22 bastproduction
debug1: identity file /Users/tiziano/.ssh/wikipedia type 0
debug1: identity file /Users/tiziano/.ssh/wikipedia-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.9
Password:

> ssh -vvv -i ~/.ssh/wikipedia piccardi@bast3004.wikimedia.org

OpenSSH_7.9p1, LibreSSL 2.7.3
debug1: Reading configuration data /Users/tiziano/.ssh/config
debug1: /Users/tiziano/.ssh/config line 1: Applying options for *
debug1: /Users/tiziano/.ssh/config line 2: Deprecated option "useroaming"
debug1: /Users/tiziano/.ssh/config line 4: Applying options for *
debug1: /Users/tiziano/.ssh/config line 29: Applying options for *.wikimedia.org
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug1: Executing proxy command: exec ssh -a -W bast3004.wikimedia.org:22 bastproduction
debug1: identity file /Users/tiziano/.ssh/wikipedia type 0
debug1: identity file /Users/tiziano/.ssh/wikipedia-cert type -1
debug1: identity file /Users/tiziano/.ssh/wikipedia type 0
debug1: identity file /Users/tiziano/.ssh/wikipedia-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.9
Password:

> ls -lh ~/.ssh

<file omitted...>

-rw-------@ 1 tiziano  staff   3.2K Jul  3  2018 wikipedia
-rw-r--r--  1 tiziano  staff   750B Jul  3  2018 wikipedia.pub

We talked on IRC debugged a bit more and Tiziano could confirm logging in works with the existing key after moving the ssh config file out of the way temp. It is using the wrong (default id_rsa) key for some reason. So we should not have to replace it and issue should not be on the server side.