Page MenuHomePhabricator

Grant root on MediaWiki maintenance hosts to perf-roots
Closed, ResolvedPublic

Description

Upon noticing error log spam coming from mwmaint1002 and looking at htop I realized I couldn't run

ls -laR /var/run/screen/

I was a bit surprised that perf-roots has root for appservers/jobrunners but not the maintenance hosts. It seems like that was an oversight.

Requesting: perf-roots be given sudo on mwmaint

Ops Clinic Duty Checklist for Access Requests

Most requirements are outlined on https://wikitech.wikimedia.org/wiki/Requesting_shell_access

This checklist should be used on all access requests to ensure that all steps are covered. This includes expansion to access. Please do not check off items on the list below unless you are in Ops and have confirmed the step.

  • - User has signed the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document.
  • - User has a valid NDA on file with WMF legal. (This can be checked by Operations via the NDA tracking sheet & is included in all WMF Staff/Contractor hiring.)
  • - User has provided the following: wikitech username, preferred shell username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform.)
  • - User has provided a public SSH key. ThtyMCS access, no shared keys.)
  • - access request (or expansion) has sign off of WMF sponsor/manager (sponsor for volunteers, manager for wmf staff)
  • - non-sudo requests: 3 business day wait must pass with no objections being noted on the task
  • - sudo requests: all sudo requests require explicit approval during the weekly operations team meeting. No sudo requests will be approved outside of those meetings without the direct override of the Director of Operations.
  • - Patchset for access request

Event Timeline

jbond updated the task description. (Show Details)
jbond triaged this task as Medium priority.Mar 7 2019, 11:12 AM

I agree it's almost like an oversight. perf-roots have root on appservers and mwmaint should count as a special kind of appserver imho. +1

Change 496761 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] admins: add perf-roots on mediawiki-maintenance servers

https://gerrit.wikimedia.org/r/496761

Change 497840 had a related patch set uploaded (by Effie Mouzeli; owner: Effie Mouzeli):
[operations/puppet@production] admin: add perf-roots to admin::groups for mwmaint*

https://gerrit.wikimedia.org/r/497840

Change 496761 abandoned by Dzahn:
admins: add perf-roots on mediawiki-maintenance servers

Reason:
done by Effie in https://gerrit.wikimedia.org/r/c/operations/puppet/ /497840

https://gerrit.wikimedia.org/r/496761

We will have this in our Monday SRE meeting and it can get merged once approved.

Change 497840 merged by Dzahn:
[operations/puppet@production] admin: add perf-roots to admin::groups for mwmaint*

https://gerrit.wikimedia.org/r/497840

Dzahn updated the task description. (Show Details)

This request has been approved in today's SRE meeting and code is now merged.

perf-roots members now have shell access on mwmaint, verified on mwmaint1002.