We need a few things for this to be granted:

• - please determine (perhaps with @Gehel) exactly what groups you should be added to for access
• - review and sign the L3 document. (done on Thu, Mar 23, 22:53)
• - NDA confirmation from WMF legal (required for all non-staff)
• - 3 day business wait for approval (cannot really start until we determine what groups you need access to)
• - need email address to tie to @Pnorman's shell account.

• group for access: maps-admin, kartotherian-admin, tilerator-admin
• NDA confirmation: Paul should have signed an NDA as part of his contractor onboarding, not sure how we need to get legal to confirm this
• email address: I'll let Paul confirm this

@Gehel,

I've emailed @RStallman-legalteam to comment on this task, they (legal, but more specifically Rachel so far) handle the NDA confirmations.

I am very much sponsoring Paul for his SSH access to the maps cluster.

Confirming that Paul Norman has a current contract with WMF which includes NDA language. This will cover the NDA requirement until the contract expires.

@RStallman-legalteam Thank you! I see we also have "expiry_date" and "expiry_contact" (email address) in our code for access for contractors and you are a contact for at least one of them. Should we add you for Paul as well and is there an expiry date?

• need email address to tie to @Pnorman's shell account.

There is an existing wikitech user "pnorman" with a @mac.com email address. UID 16082. That's the right one? @Pnorman

Yes, my email is penorman@mac.com

This access request has been approved in today's ops meeting.

@ Dzhan - I have a record of May 31, 2017 as the current contract expiration. However, legal did not finalize this contract. Depending on the arrangement with the contractor, either legal or HR processes contracts. Paul's was ultimately done through HR, so I wouldn't be in the loop regarding renewal. I believe Katie Horn or Lani Goto would be the best to check in with regarding extension, etc. Thanks!

Change 345066 had a related patch set uploaded (by Dzahn):
[operations/puppet@production] admin: create shell account for Paul Norman

https://gerrit.wikimedia.org/r/345066

Thank you @RStallman-legalteam (and also for the other approval earlier). I have added hr@wikimedia.org as contact for now.

In T161274#3128369, @RobH wrote:

We need a few things for this to be granted:

• - please determine (perhaps with @Gehel) exactly what groups you should be added to for access
• - review and sign the L3 document. (done on Thu, Mar 23, 22:53)
• - NDA confirmation from WMF legal (required for all non-staff)
• - 3 day business wait for approval (cannot really start until we determine what groups you need access to)
• - need email address to tie to @Pnorman's shell account.

^ @Pnorman all looks good, it's just that last check box now. ^. thanks for your patience.

Change 345066 merged by Dzahn:
[operations/puppet@production] admin: create shell account for Paul Norman

https://gerrit.wikimedia.org/r/345066

Change 345196 had a related patch set uploaded (by Dzahn):
[operations/puppet@production] admin: add pnorman to maps/kartotherian/tilerator-admins

https://gerrit.wikimedia.org/r/345196

Change 345196 merged by Dzahn:
[operations/puppet@production] admin: add pnorman to maps/kartotherian/tilerator-admins

https://gerrit.wikimedia.org/r/345196

Hi @Pnorman,

so after this merge your shell user has been created on the bastion hosts. From there on you should have been able to SSH to them. See ssh config examples on wikitech.

Then since this merge your user is now being created on the maps servers (for example maps1001.eqiad.wmnet and the others). I have already confirmed it on maps1001 and the others will follow within the next 30 min max. automatically.

In the ssh config above you can see how to use ProxyCommand to jump via the bastion hosts to the internal servers.

If you look here in the repository operations/puppet for your own user name, you can see which commands exactly you can run with sudo.

And in site.pp if you look for nodes using the role maps::server you can see the host names/regexes of everything you have access to.

Let us know if any trouble connecting.

Daniel