Page MenuHomePhabricator

Requesting access to researchers and analytics-privatedata-users for Leila Zia
Closed, ResolvedPublicRequest

Description

Requestor provided information and prerequisites

  • Wikitech username: Leizi
  • Preferred shell username: leila
  • Email address: leila@wikimedia.org
  • Ssh public key (must be dedicated key for wmf production): ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICPnKMMpXEX5hRWvuy591pfgtdezDUE+ZHJf/RCf/PbX root@maracuja
  • Requested group membership: researchers and analytics-privatedata-users
  • Reason for access: research with data on the Hadoop cluster.
  • Name of approving party (hiring manager for WMF staff): Grant Ingersoll
  • Requestor -- Please Acknowledge that you have read and signed the L3 Wikimedia Server Access Responsibilities document: I acknowledge. --Leila
  • Requestor -- Please coordinate obtaining a comment of approval on this task from the approving party.

SRE Clinic Duty Confirmation Checklist for Access Requests

This checklist should be used on all access requests to ensure that all steps are covered, including expansion to existing access. Please double check the step has been completed before checking it off.

This section is to be confirmed and completed by a member of the SRE team.

  • - User has signed the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document.
  • - User has a valid NDA on file with WMF legal. (This can be checked by Operations via the NDA tracking sheet & is included in all WMF Staff/Contractor hiring.)
  • - User has provided the following: wikitech username, preferred shell username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform)
  • - User has provided a public SSH key. This ssh key pair should only be used for WMF cluster access, and not share with any other service (this includes not sharing with WMCS access, no shared keys.)
  • - access request (or expansion) has sign off of WMF sponsor/manager (sponser for volunteers, manager for wmf staff) - in this case the user has already been approved in the past.
  • - Patchset for access request

For additional details regarding access request requirements, please see https://wikitech.wikimedia.org/wiki/Requesting_shell_access

Event Timeline

leila created this task.Oct 2 2020, 8:50 PM
Restricted Application added a project: Operations. · View Herald TranscriptOct 2 2020, 8:50 PM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
leila added a subscriber: gsingers.Oct 2 2020, 8:52 PM

@gsingers Please review and approve if you are fine with it.

Kormat added a subscriber: Kormat.EditedOct 5 2020, 2:29 PM

Hi Leila,

I'm the SRE clinic duty person this week :)

When looking at this task, i noticed a few odd things:

leila added a comment.Oct 6 2020, 4:34 AM

Hi Leila,

I'm the SRE clinic duty person this week :)

lovely. thanks for helping me. :)

When looking at this task, i noticed a few odd things:

hmm. this is bad. So here is how I'd like to clear this up, thanks for your help:

  • let's keep leila separate from leila@wikimedia. I use that for the volunteer work I do and I'd rather not have it mixed.
  • labello: please remove it. (it's a cute username though.;)
  • leizi can remain my wmf wikitech account.

Yes. actually I only need the SSH key replaced, perhaps. (I don't have access to the old key.) (I understand that this means my shell account name will be different than my wmf wikitech username. I can live with this inconsistency.)

  • The account is in the analytics-privatedata-users group. Is that the access you need?

That plus researchers.

Thank you!

Kormat updated the task description. (Show Details)Oct 6 2020, 11:51 AM
elukey added a subscriber: elukey.Oct 6 2020, 12:18 PM

I know that it seems strange but the researchers group is not needed for you @leila, it is an old one that we'll deprecate :)

Hi Leila,

Thanks for your reply, things are a lot clearer now :)

The existing shell account is associated with your volunteer wikitech account (User:Leila). After some discussion with my colleagues, the best way to proceed at this point is to mark that shell account as closed, and create a new one that's associated with your wmf wikitech account (User:Leizi). What is your preferred name for this new shell account? It needs to be different than leila, unfortunately.

I've sent you a message on gchat to confirm the ssh key with you.

You are already a member of the analytics-privatedata-users group, but it looks like a requirement for a kerberos authentication principal has been added in the meantime (https://wikitech.wikimedia.org/wiki/Analytics/Data_access#Access_Groups). Given the circumstances, i'll create the principal for you once you've confirmed your preferred shell account name :)

leila added a comment.Oct 6 2020, 3:46 PM

@elukey ok. :)

@Kormat let's go with leizi. Thanks! :)

Change 632726 had a related patch set uploaded (by Kormat; owner: Kormat):
[operations/puppet@production] admin: Replace leila with leizi

https://gerrit.wikimedia.org/r/632726

Kormat added a comment.Oct 7 2020, 1:29 PM

@leila: Ok, we're almost ready to go. The only remaining thing is to confirm your ssh key over a medium we have more confidence in (due to the sensitive nature of production access). I've sent you a message on google chat, and on WMF slack. If you can reply to either of those with your ssh public key, then I can submit https://gerrit.wikimedia.org/r/632726 and you'll be good to go.

I've created your kerberos principal earlier today, you should receive an email telling you how to set the password for it.

Cheers :)

Kormat updated the task description. (Show Details)Oct 7 2020, 1:30 PM
leila added a comment.Oct 7 2020, 8:52 PM

@Kormat thanks. I just confirmed the ssh key through the slack message I had received about it.

Kormat updated the task description. (Show Details)Oct 8 2020, 8:54 AM

Change 632726 merged by Kormat:
[operations/puppet@production] admin: Replace leila with leizi

https://gerrit.wikimedia.org/r/632726

@leila: Your access should now be active. Please let me know if you run into any issues.

I've opened a couple of subtasks to cover cleanup of the old state.

The "leila" account also needs to be removed from the wmf LDAP group.

Kormat added a comment.Oct 9 2020, 7:40 AM

The "leila" account also needs to be removed from the wmf LDAP group.

Good catch, done.

JMeybohm triaged this task as Medium priority.Oct 13 2020, 9:51 AM

I've created your kerberos principal earlier today, you should receive an email telling you how to set the password for it.

@leila have you received the email with the kerberos temporary password? If so you should follow up and change it (see https://wikitech.wikimedia.org/wiki/Analytics/Systems/Kerberos/UserGuide#Authenticate_via_Kerberos)

leila added a comment.Oct 14 2020, 8:58 PM

@elukey I did receive the kerberos temp password and just changed it. thanks!

Is this fully done?

MoritzMuehlenhoff closed this task as Resolved.Oct 19 2020, 6:45 AM

For the followup work with the old home there's T264994, so we can close this.