Thank you for the notes, and absolutely approved! @JMando is a 40-hour / week. long-term contractor in a senior level position with a full confidentiality agreement who is a core member of our team. He will need access to production data on stat100x machines in order to query, model, and analyze data that impacts Fundraising Analytics outcomes, such as pageviews and banner history event collection during Fundraising campaigns.

I'm happy to provide more details about use cases we have in Fundraising (and will have in the future) for this data, as well as provide documentation that @JMando has already signed if it would be helpful.

BTW, @JMando 'researchers' is a deprecated role, DE team is likely to suggest a different group for your access, probably the other one you are asking for: analytics-privatedata-users Check also https://wikitech.wikimedia.org/wiki/Analytics/Data_access#What_access_should_I_request? to understand if you will need kerberos access (for Hadoop, Hive, Presto access).

@jcrespo I spoke with @EYener and it looks like I will need kerberos access. Should I make a separate ticket for that?

No need for another ticket, just making it explicit on the 'Requested group membership' section on the description above will make me not forget it when deploying the change 0:-) Thank you!

@jcrespo Hi Jaime, Joseph Mando is a currently contractor wit the WMF and therefore the NDA is covered under the contractor agreement signed. Thanks!

@JMando One last thing I need from you is- some contractors/researchers/grantees have an end of contact date- If you have one (can be extended later) I will need it to note it on the access properties so we can contact @EYener ahead of time so there is no interruptions on your access near renewals.

@jcrespo Right now that date is July 19, 2022.

Thank you! Now only waiting on Analytics final approval.

I think I can still approve these for Analytics access. Approved!

Change 715920 had a related patch set uploaded (by Filippo Giunchedi; author: Filippo Giunchedi):

[operations/puppet@production] admin: add jmando

https://gerrit.wikimedia.org/r/715920

Change 715920 merged by Filippo Giunchedi:

[operations/puppet@production] admin: add jm

https://gerrit.wikimedia.org/r/715920

@JMando access has been set up, please confirm the following:

• SSH access is working
• the kerberos initial password (sent via email) has been changed

thank you!

Hi all! Thank you for working on this and granting access for @JMando! We have been working from the level of access authorized, which you've all granted, to trying to confirm that we can login as expected, and hitting some roadblocks - probably user error on my part, as I'm guessing the instructions I've written up have changed since I last checked.

It would be much appreciated if you could help me figure out a few questions I have or point me toward the correct documentation.

• Now that stat machine access is granted, and assuming the config file is correctly written, what is the manual command for access to the stat machines? I have previously used ssh stat1007.eqiad.wmnet but this no longer appears to be working (for me or for @JMando)
• There are several UIs that I was assuming would be accessible once we were given the 'okay' but @JMando got a 'permissions denied' error. The portals are those for Hue, Turnilo, and Superset (links below). Could you advise on how to access or which credentials to use?

URLS for Hue, Turnilo, and Superset:
https://hue.wikimedia.org/hue/editor/?type=hive
https://turnilo.wikimedia.org/
https://superset.wikimedia.org/superset/welcome

Thanks for your help!

In T289606#7329757, @EYener wrote:

Hi all! Thank you for working on this and granting access for @JMando! We have been working from the level of access authorized, which you've all granted, to trying to confirm that we can login as expected, and hitting some roadblocks - probably user error on my part, as I'm guessing the instructions I've written up have changed since I last checked.

It would be much appreciated if you could help me figure out a few questions I have or point me toward the correct documentation.

• Now that stat machine access is granted, and assuming the config file is correctly written, what is the manual command for access to the stat machines? I have previously used ssh stat1007.eqiad.wmnet but this no longer appears to be working (for me or for @JMando)

I verified the host stat1007.eqiad.wmnet is up and ssh-accessible for me, could you check your configuration against https://wikitech.wikimedia.org/wiki/SRE/Production_access#Setting_up_your_access ? And paste the error from ssh -v stat1007.eqiad.wmnet when connecting? Thank you!

• There are several UIs that I was assuming would be accessible once we were given the 'okay' but @JMando got a 'permissions denied' error. The portals are those for Hue, Turnilo, and Superset (links below). Could you advise on how to access or which credentials to use?

This was an oversight on my part, as nda LDAP group access was missing, web access should be working now! Please confirm

Thanks! Error for me when I ssh -v stat1007.eqiad.wmnet:

eyener@wmf2395 ~ % ssh stat1007 -v eqiad.wmnet
OpenSSH_8.1p1, LibreSSL 2.7.3
debug1: Reading configuration data /Users/eyener/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 47: Applying options for *
debug1: hostname canonicalisation enabled, will re-parse configuration
debug1: re-parsing configuration
debug1: Reading configuration data /Users/eyener/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 47: Applying options for *
debug1: Connecting to stat1007 port 22.
ssh: Could not resolve hostname stat1007: nodename nor servname provided, or not known

@EYener you typed ssh stat1007 -v eqiad.wmnet, try ssh -v stat1007.eqiad.wmnet :)

Oh yes. That will help. :) Connected, thank you!

Fantastic, thank you @EYener and @Ottomata ! Awaiting confirmation of access from @JMando

I am in now. I can access those UI's and successfully ssh into stat1007. Thank you!

http://localhost:8880