Page MenuHomePhabricator

NRodriguez uses the same SSH key(s) in WMCS and production
Closed, ResolvedPublic

Description

Our cross-validation script discovered that user @NRodriguez is using the same key in cloud and production.

This is a violation of the L3 server access agreement. As such, this task is tracking the revocation of production access UNTIL a stand alone key can be provided by user @NRodriguez for use on the production cluster.

Natalia: You will need to generate a new keypair dedicated ONLY to use on WMF production cluster and no where else. Once that is done, you can comment on this task with it and either myself (or whoever is on clinic duty if next week) will process and add this back.

Event Timeline

Change 754472 had a related patch set uploaded (by Jelto; author: Jelto):

[operations/puppet@production] admin: revoke natalia-rodriguez key

https://gerrit.wikimedia.org/r/754472

Change 754472 merged by Jelto:

[operations/puppet@production] admin: revoke natalia-rodriguez key

https://gerrit.wikimedia.org/r/754472

@NRodriguez I've merged the revocation of the SSH key used on the production cluster. This was due to it also being used in WMCS, and thus compromised as a WMF production key. We require a dedicated wmf production ssh key, not used anywhere else, for your access.

Your access is currently suspended until this is resolved. Please generate a new ssh keypair, and update this task with the public key via comment and then assign back in this task.

Jelto triaged this task as Medium priority.

Big apologies for the hiccup, I've generated a new key:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINSGlZdKKkUD0ra0jpnABXYQXRLowZe/q3fm49cDVGkM nrodriguez@wikimedia.org

Change 757488 had a related patch set uploaded (by JHathaway; author: JHathaway):

[operations/puppet@production] NRodriguez: add new production ssh key

https://gerrit.wikimedia.org/r/757488

@NRodriguez would you kindly send your ssh public key via google chat, or via phabricator with the Add Action Sign with MFA option when you post? Thanks!

Change 757488 merged by JHathaway:

[operations/puppet@production] NRodriguez: add new production ssh key

https://gerrit.wikimedia.org/r/757488

@NRodriguez this change has been committed, should be ready to test in 30 or so minutes.

Hi @NRodriguez, Can you access production now? So we can close this ticket. Thanks!

I boldly close this to remove it from our board. Reopen if you have issues accessing.