Maniphest T196466

Remove 'shell user' right on wikitech
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Andrew
	Jun 5 2018, 1:44 PM

Description

Wikitech has a 'shell user' user right. This used to be checked before permitting logins; I don't know if it still is, or how it's checked if it is.

As we move our developer account workflow away from wikitech, having logins require a particular bit on a particular wiki seems wrong. If bit right is already ignored, then we should remove it from wikitech; if it's still used we should replace it or ignore it and rely on keystone roles exclusively.

Details

	Subject	Repo	Branch	Lines +/-
	[wikitech] Remove the 'shell' user right from assignment and rights lists	operations/mediawiki-config	master	+0 -3

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Open	None	T189531 All Wikimedia developer services should use single sign-on
Open	None	T161859 Make Wikitech an SUL wiki
Resolved	Clement_Goubert	T327920 March 2023 Datacenter Switchover
Open	Clement_Goubert	T328907 Post March 2023 Datacenter Switchover Tasks
Duplicate	None	T237771 Make Wikitech a normal wiki
Open	None	T305233 consider eliminating labweb/cloudweb hardware servers
Open	None	T237773 Move Wikitech onto the production MW cluster
Resolved	taavi	T237890 Remove and empty useless user groups
Resolved	Jdforrester-WMF	T196466 Remove 'shell user' right on wikitech

Event Timeline

Andrew created this task.Jun 5 2018, 1:44 PM

Quiddity subscribed.Jun 5 2018, 4:57 PM

AFAIK this used be a way to disable abusive accounts (by removing this right they could no longer log in, which normal blocking on wikitech didn't do iirc). Did keystone roles take that functionality over? Even if rarely used, there should be a easy way to disable abusive accounts on wmcs.

• Vvjjkkii renamed this task from Review (and remove?) use of 'shell user' right on wikitech to xlbaaaaaaa.Jul 1 2018, 1:06 AM

• Vvjjkkii triaged this task as High priority.

• Vvjjkkii added projects: CheckUser, Connected-Open-Heritage-Batch-uploads (RAÄ-KMB_1_2017-02), Tamil-Sites, Gamepress, Hashtags, Jade, KartoEditor, Language-2018-Apr-June, New-Editor-Experiences, Mail, TCB-Team (now WMDE-TechWish).

• Vvjjkkii updated the task description. (Show Details)

• Vvjjkkii removed subscribers: MarcoAurelio, gerritbot, Aklapper.

TerraCodes renamed this task from xlbaaaaaaa to Review (and remove?) use of 'shell user' right on wikitech.Jul 1 2018, 12:55 PM

TerraCodes raised the priority of this task from High to Needs Triage.

TerraCodes updated the task description. (Show Details)

TerraCodes removed projects: TCB-Team (now WMDE-TechWish), Mail, New-Editor-Experiences, Language-2018-Apr-June, KartoEditor, Jade, Hashtags, Gamepress, Tamil-Sites, Connected-Open-Heritage-Batch-uploads (RAÄ-KMB_1_2017-02), CheckUser.

TerraCodes added subscribers: gerritbot, MarcoAurelio, Aklapper.

Liuxinyu970226 subscribed.Nov 6 2018, 12:33 PM

• GTirloni edited projects, added cloud-services-team (Kanban); removed cloud-services-team.Mar 24 2019, 12:03 PM

Meno25 subscribed.May 31 2019, 4:29 PM

Reedy removed a project: MediaWiki-extensions-OpenStackManager.Nov 10 2019, 3:53 AM

In T196466#4260440, @EddieGP wrote:

AFAIK this used be a way to disable abusive accounts (by removing this right they could no longer log in, which normal blocking on wikitech didn't do iirc). Did keystone roles take that functionality over? Even if rarely used, there should be a easy way to disable abusive accounts on wmcs.

Blocking an account on Wikitech disables the associated Developer account including preventing new ssh sessions to Cloud VPS projects. The checks for this are in ssh-key-ldap-lookup.py in ops/puppet.

bd808 renamed this task from Review (and remove?) use of 'shell user' right on wikitech to Remove 'shell user' right on wikitech.Nov 10 2019, 11:43 PM

bd808 triaged this task as Medium priority.

bd808 edited parent tasks, added: T237773: Move Wikitech onto the production MW cluster; removed: T196171: Developer account creation without OpenStackManager.Nov 11 2019, 12:01 AM

Reedy added a parent task: T237890: Remove and empty useless user groups.Nov 11 2019, 12:08 AM

bd808 moved this task from Backlog to Config on the wikitech.wikimedia.org board.Nov 11 2019, 12:29 AM

Mentioned in SAL (#wikimedia-operations) [2020-02-28T01:05:01Z] <James_F> Running mwscript emptyUserGroup.php --wiki=labswiki shell for T196466

Change 575387 had a related patch set uploaded (by Jforrester; owner: Jforrester):
[operations/mediawiki-config@master] [wikitech] Remove the 'shell' user right from assignment and rights lists

https://gerrit.wikimedia.org/r/575387

gerritbot added a project: Patch-For-Review.Feb 28 2020, 1:11 AM

Change 575387 merged by jenkins-bot:
[operations/mediawiki-config@master] [wikitech] Remove the 'shell' user right from assignment and rights lists

https://gerrit.wikimedia.org/r/575387

Mentioned in SAL (#wikimedia-operations) [2020-02-28T01:19:30Z] <jforrester@deploy1001> Synchronized wmf-config/InitialiseSettings.php: T196466 [wikitech] Remove the 'shell' user right from assignment and rights lists (duration: 00m 58s)