Page MenuHomePhabricator

Remove 2FA on wikitech for user Szczot3k
Closed, ResolvedPublic

Description

Per email from user:Szczot3k (@Szczot3k), sent to ca@wikimedia.org from the email address attached to their Wikitech account (I can confirm this was the same, though perhaps you'd want other forms of verification?)

Event Timeline

bd808 subscribed.

We typically do not trust email as a verification for disabling 2FA. There is a process documented at https://wikitech.wikimedia.org/wiki/Password_reset#For_users that can be used to establish higher trust using ssh.

Instructions for actually disabling 2FA on a Developer account are at https://wikitech.wikimedia.org/wiki/Password_reset#Wikimedia_or_wikitech_two_factor_authentication_removal

I've got two keys saved as "wikitech" on my backup disk.
However, I can't get SSH access with them.

Can someone verify my shell login? I've tried Szczot3k and szczot3k.

When I'm trying to connect with U: szczot3k and the newer key it closes the connection.
I've got access to SUL user:Szczot3k.

~ >>> ssh szczot3k@bastion.wmflabs.org                                                                                                                                
Enter passphrase for key '/home/fkszczot/.ssh/bastion.wmf': 
Connection closed by 185.15.56.13 port 22
~ >>> ssh Szczot3k@bastion.wmflabs.org                                                                                                                           [255]
Enter passphrase for key '/home/fkszczot/.ssh/bastion.wmf': 
Szczot3k@bastion.wmflabs.org: Permission denied (publickey).

RSA key fingerprints:
2048 SHA256:lLkMtP87o4esR/7X5lQEcoHkVr6YCzKQQORKvB8lozQ szczot3k@wikitech (RSA) [Newer]
2048 SHA256:IHaZshRSt3KtrUAE2XSb9+pqKF6JizQNHXA78vYX6d8 ((my email)) (RSA) [Older}

The User:Szczot3k Developer account has a shell account name of 'szczot3k'. The account is configured to allow ssh using this public key:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxpn8NIXymJDxS++xlzOymXIqb8u6l+7aNq1xQEsnLTxdXmHrMxZl5IUEjQYVGey0IPqscGZL4n2bRg5RsResP0QgdqZ3GRNLMPD+6MQr2j+a0CMQLFIsHLv9UoTOH/WYIrHoAiL7Z/N39hjY4WlhTXEfUdpOVJ8VvJ9ZysC/WR4DJ9pg/XDLTWJVzcA+TIGFFKU+/qZXnZrfCRe1Bf2JdHMTmpINTpoWeZ6UYFLEEnEt+11fyAOGKtD7MFXOSNvvJdzjZUgF/ArgYddks10QiSr87jHGRgL5c6Q71+mvwQCrsiascE/P323gN1KldoWMyNKOy2DdDL6ASL8iRlU7D szczot3k@wikitech

When I'm trying to connect with U: szczot3k and the newer key it closes the connection.
I've got access to SUL user:Szczot3k.

~ >>> ssh szczot3k@bastion.wmflabs.org                                                                                                                                
Enter passphrase for key '/home/fkszczot/.ssh/bastion.wmf': 
Connection closed by 185.15.56.13 port 22
~ >>> ssh Szczot3k@bastion.wmflabs.org                                                                                                                           [255]
Enter passphrase for key '/home/fkszczot/.ssh/bastion.wmf': 
Szczot3k@bastion.wmflabs.org: Permission denied (publickey).

You are attempting to ssh into bastion.wmflabs.org. The szczot3k user does not have access to this server because it is not a member of the "bastion" Cloud VPS project. I can see auth.log records showing that the ssh key exchange succeeded but then the group membership test failed causing the ssh connection to be closed: "sshd[3425]: fatal: Access denied for user szczot3k by PAM account configuration [preauth]".

The account does have access to the login.toolforge.org bastion via its membership in the Toolforge project.

I've used login.toolforge.org bastion to verify that I've got the access to my private key - tools-sgebastion-07.tools.eqiad.wmflabs:/home/szczot3k/2fa-reset-request.txt

nskaggs moved this task from Inbox to Clinic Duty on the cloud-services-team (Kanban) board.
bd808 claimed this task.
$ sudo ls -alh /home/szczot3k/2fa-reset-request.txt
-rw------- 1 szczot3k wikidev 42 Aug 11 15:32 /home/szczot3k/2fa-reset-request.txt
$ sudo cat /home/szczot3k/2fa-reset-request.txt
https://phabricator.wikimedia.org/T260096
$ mwscript extensions/OATHAuth/maintenance/disableOATHAuthForUser.php --wiki=labswiki 'Szczot3k'
OATHAuth disabled for Szczot3k.