Requesting shell access, deployment and analytics-privatedata-users rights for acooper
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	sbassett
	Sep 7 2023, 6:11 PM

Description

Requestor provided information and prerequisites

This section is to be completed by the individual requesting access.

Wikitech username: acooper
Preferred shell username: acooper
Email address: acooper@wikimedia.org
Ssh public key (must be dedicated key for wmf production):

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDXa77KGOhC4qjgA2ocjjbcbhlBvKTFgwZ+gMqYbyASuPVxXedb43R0fea7H+LLTsdYkbAVli3NaxsvjkDk4kk1gaIP3d+W+1k/a+Wbqv8/i+MO+D/gcaOm4UeiCDWaER12fbaNwkO2eOhBlpNPNTmyCfJtXblFXLwkDKL/Q2hDuPhIvklzYucZN/vQH0/E/xF0lPgK6teNq8OJDDpC2Q/WBuO0tHLxX26R5x6t1mCF/UE/FyPPnAayCcE2C/ljgrsM/dLIqxuIEWNpwoGvpTTUToy23PM5XdAuN+J/fS6Qk4ZscP/N+STT99DaPvE19GqAioiJMoZLiL7MaWY5gDxiH+5nT8OgakLHmWG5/19shs7pcpitznubofPJbhB5Fb+iRyehwDaP0BvbPkmhPd6SNrEjBkC5DdT+oBfqQbwcd04IrBI1QIkXADhpjm5Up6AzgFVbuHIXFd77wMwgnmADKGJWA2iXYFMd+FPsN6sSyKDK1PNK2kavixv7jfL7fbrSaEDpLhzvtzIrY0FUiHWbU+z1m4nh1ZTQaJwI4xUdUismv15ZN3jCctsFubJG6+X2pus15aarvGZOUh5Q8SVgmFCyBmpuBgLJiZFSp7vTP1vGENOAlb29isBR+h0g3AnPYAjlt8p014RHfoFB9QpTQk3sAyyl8Aocj2gOj53cMw== cardno:23 464 726

Requested group membership: deployment, analytics-privatedata-users
Reason for access: As part of his work leading and working on engineering projects for the Security-Team
Name of approving party (hiring manager for WMF staff): @mark
Requestor -- Please Acknowledge that you have read and signed the L3 Wikimedia Server Access Responsibilities document: done

SRE Clinic Duty Confirmation Checklist for Access Requests

This checklist should be used on all access requests to ensure that all steps are covered, including expansion to existing access. Please double check the step has been completed before checking it off.

This section is to be confirmed and completed by a member of the SRE team.

- User has signed the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document.
- User has a valid NDA on file with WMF legal. (This can be checked by Operations via the NDA tracking sheet & is included in all WMF Staff/Contractor hiring.)
- User has provided the following: wikitech username, preferred shell username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform)
- User has provided a public SSH key. This ssh key pair should only be used for WMF cluster access, and not share with any other service (this includes not sharing with WMCS access, no shared keys.)
- access request (or expansion) has sign off of WMF sponsor/manager (sponser for volunteers, manager for wmf staff)
- non-sudo requests: 3 business day wait must pass with no objections being noted on the task
- Patchset for access request

For additional details regarding access request requirements, please see https://wikitech.wikimedia.org/wiki/Requesting_shell_access

Details

	Subject	Repo	Branch	Lines +/-
	admin: Grant shell access to acooper	operations/puppet	production	+10 -6

Customize query in gerrit

Related Objects

Mentioned Here: T336769: Update network SSH keys to ssh-ed25519

Event Timeline

sbassett created this task.Sep 7 2023, 6:11 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 7 2023, 6:11 PM

sbassett renamed this task from Requesting access to deployment rights for acooper to Requesting shell access, deployment and analytics-privatedata-users rights for acooper.Sep 7 2023, 6:12 PM

deployment membership requires the approval of @thcipriani and analytics-privatedata-users of @odimitrijevic / @Milimetric

we also need the approval of their manager, @mark

we are also pending on @acooper submitting their public SSH key

I almost forgot, for analytics-privatedata-users I'm assuming @acooper needs a kerberos principal as well, details available on https://wikitech.wikimedia.org/wiki/Analytics/Data_access

Fabfur subscribed.Sep 8 2023, 9:07 AM

acooper changed the task status from Stalled to Open.Sep 8 2023, 11:10 AM

acooper updated the task description. (Show Details)

Thanks I added the SSH key.

I'll ask Mark to approve.

Approved.

Vgutierrez updated the task description. (Show Details)Sep 8 2023, 1:11 PM

thanks! @acooper RSA keys are being deprecated in some parts of our infrastructure already (T336769), so I'm wondering if you could provide an ed25519 one rather than a rsa-4096. This should be totally feasible with a yubikey 5 (I'm guessing you're using one due to the cardno comment from your SSH key)

I followed these instructions already which requested rsa type (maybe worth updating the instructions if ed25519 is preferred now?)
https://wikitech.wikimedia.org/wiki/Yubikey-SSH

My concern now is, I'm not 100% sure how to deal with the existing key (delete it?) and what the alternative steps would be. Do you know if its documented anywhere for ed25519?

Change 955940 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] admin: Grant shell access to acooper

https://gerrit.wikimedia.org/r/955940

gerritbot added a project: Patch-For-Review.Sep 8 2023, 1:25 PM

In T345877#9152356, @acooper wrote:

I followed these instructions already which requested rsa type (maybe worth updating the instructions if ed25519 is preferred now?)
https://wikitech.wikimedia.org/wiki/Yubikey-SSH

My concern now is, I'm not 100% sure how to deal with the existing key (delete it?) and what the alternative steps would be. Do you know if its documented anywhere for ed25519?

procedure is the same, you just should pick ECC and then Curve 25519 (ed25519 / cv25519) instead of RSA keys. A step by step guide on generating ed25519/cv25519 keys with gpg is available on https://wiki.gentoo.org/wiki/GnuPG#Key_management, besides that https://wikitech.wikimedia.org/wiki/Yubikey-SSH is still up-to-date.

Vgutierrez moved this task from Awaiting User Input to Manager/NDA Approval/Confirmation on the SRE-Access-Requests board.Sep 8 2023, 1:32 PM

just to be the clear the RSA key is totally valid at this point, I just wanted to save @acooper more "pain" further down the line. The task currently waiting for @thcipriani and @odimitrijevic / @Milimetric approvals :)

approved!

Thanks!, still blocked on @thcipriani for deployment group membership

In T345877#9174389, @Vgutierrez wrote:

Thanks!, still blocked on @thcipriani for deployment group membership

Sorry for delay! Approved!

Change 955940 merged by Vgutierrez:

[operations/puppet@production] admin: Grant shell access to acooper

https://gerrit.wikimedia.org/r/955940

Patch has been merged, it should be effective in ~30 minutes when puppet runs. @acooper should have received an email to change the password of his kerberos principal.

Vgutierrez removed a project: Patch-For-Review.Sep 20 2023, 8:30 AM

Vgutierrez updated the task description. (Show Details)

Requesting shell access, deployment and analytics-privatedata-users rights for acooperClosed, ResolvedPublicActions