We need manager sign-off, and @RStallman-legalteam should verify here that the appropriate NDA has been signed and is on file.

Thanks for opening this ticket! I confirm that the NDA is signed and on file.

In T223496#5189888, @ArielGlenn wrote:

We need manager sign-off

Pinging @georgina

Approved

I'm Irene's manager and I approve the request. Thanks everyone!

(and wmf and nda groups, if not already, as those are required for Hue).

Normally this is an OR, and all logins i am aware of are configured to allow "either WMF or NDA". We use the WMF group for employees and the NDA group for volunteers and external contractors with an NDA. I see you have a @wikimedia.org email address though it doesn't follow the usual naming scheme. Are you an employee?

edit: nevermind, i see "WMF data analyst contractor".

That explanation is helpful. Thank you!

need access to stat1004, stat1005 (now stat1007), and stat1006

Access is never based on individual host names, only on groups.

But i can confirm that:

• stat1004: analytics-privatedata-users has access
• stat1005: none of the requested groups has access but as you already said it was replaced by stat1007
• stat1006: researchers has access
• stat1007: analytics-privatedata-users has access

and to be added to these groups:

• wikidev: This is kind of a meta group that you should be automatically be added to without specifically having to add you.

• analytics-privatedata-users: Yes, added in the patch i uploaded.

• and researchers : Yes, same as above.

• and wmf and nda groups: We will add you after the code change is merged to avoid getting warning emails about an inconsistency between admin groups and LDAP groups

Change 510985 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] admins: add shell account and admin groups for iflorez

https://gerrit.wikimedia.org/r/510985

Hello,
I'm reading through the shell access notes and see that an Ed25519 SSH key is the recommended key for secure access.
I've updated this phab ticket's description with a new Ed25519 SSH key, which replaces a 2048 bit RSA SSH key. Please let me know if I should take further steps. Your feedback is appreciated. Thank you!

In T223496#5198297, @Iflorez wrote:

Hello,
I'm reading through the shell access notes and see that an Ed25519 SSH key is the recommended key for secure access.
I've updated this phab ticket's description with a new Ed25519 SSH key, which replaces a 2048 bit RSA SSH key. Please let me know if I should take further steps. Your feedback is appreciated. Thank you!

Hi Irene, thanks for doing that. I updated the patch accordingly.

Updated the ticket to include a capitalized I in the Wikitech username.

The correct Wikitech username is: Iflorez

Thanks @Iflorez for attention to detail. So the full story is that's all one LDAP user but there are different fields:

cn: Iflorez
sn: Iflorez
uid: iflorez

The non-capitalized version will become your shell user, as requested, and we match you by the UID number (21341) so we got the right user. P.S. I think the only thing that currently keeps us from resolving this ticket is that we need approval from @Nuria

We need to legal to please confirm NDA status plus also an expiration date for access for @Iflorez.

Signed NDA confirmed. Contract is through May 31, 2020.

Updating patch to include expiry_date May 31, 2020. Who should be expiry_contact? Nuria?

@Dzahn I guess @georgina would be more appropriate, the expiration contact should be related to the contractors point of contact, not the group's owner.

In T223496#5209502, @Volans wrote:

@Dzahn I guess @georgina would be more appropriate, the expiration contact should be related to the contractors point of contact, not the group's owner.

Done! Added Georgina and expiry data of May 31st 2020.

@Nuria all the pre-requisites are there, is this approved?

Approved, thanks.

Approved, yes. Many thanks.

Change 510985 merged by Volans:
[operations/puppet@production] admins: add shell account and admin groups for iflorez

https://gerrit.wikimedia.org/r/510985

Added @Iflorez to the wmf LDAP group as agreed with @MoritzMuehlenhoff

I've verified with @Iflorez that basic access to bastion and internal hosts works as expected.

Hello I've joined the Product Analytics team with @mpopov as my manager. Hooorah!

I believe that I am currently added to these groups:
analytics-privatedata-users, wmf LDAP

And need to also be added to the analytics-product-users group

Thank you!

In T223496#7206847, @Iflorez wrote:

Hello I've joined the Product Analytics team with @mpopov as my manager. Hooorah!

I believe that I am currently added to these groups:
analytics-privatedata-users, wmf LDAP

And need to also be added to the analytics-product-users group

Thank you!

Hi! Could you please create a new request by following the instructions at https://wikitech.wikimedia.org/wiki/Production_access#Filing_the_request if you need more access. Thanks!

Created new request: T286509