The access for Jimmy Ly (jly) has been removed. It needs to be checked if data was left in home dirs on stat*/HDFS since they were part of the "analytics-privatedata-users" group.
The Kerberos principal has already been removed.
Description
Description
Event Timeline
Comment Actions
No files found in HDFS for user jly
stevemunene@an-master1003:~$ sudo kerberos-run-command hdfs hdfs dfs -ls /user/jly stevemunene@an-master1003:~$
However, we do have some files on the stat1008 host. @OKryva-WMF kindly advise on whether we should keep/move the files on /home/jly or remove them, thanks.
stevemunene@cumin1003:~$ sudo cumin 'stat1*.eqiad.wmnet' 'ls /home/jly' 4 hosts will be targeted: stat[1008-1011].eqiad.wmnet OK to proceed on 4 hosts? Enter the number of affected hosts to confirm or "q" to quit: 4 ===== NODE GROUP ===== (1) stat1008.eqiad.wmnet ----- OUTPUT of 'ls /home/jly' ----- 2025-03-26_account_compromises.log compromised_wiki_user_groups.csv default_queries.ipynb hibp_compromised_accounts.csv hibp_compromised_accounts_old.csv hibp.ipynb old user_emails.csv user_emails_high_privs_short.csv usernames.csv wikimedia_domains.csv ================ PASS |██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 100% (4/4) [00:00<00:00, 7.90hosts/s] FAIL | | 0% (0/4) [00:00<?, ?hosts/s] 100.0% (4/4) success ratio (>= 100.0% threshold) for command: 'ls /home/jly'. 100.0% (4/4) success ratio (>= 100.0% threshold) of nodes successfully executed all commands.
Comment Actions
@Stevemunene : can you make those files available to @SLopes-WMF ? He can confirm when we can remove them from stat machines
Comment Actions
In communication with @SLopes-WMF and the files have been shared for review.
Thanks @Gehel
Comment Actions
@Stevemunene gave me a copy of the Jimmy's files. @Gehel, feel free to delete them now.
Comment Actions
Thanks @SLopes-WMF the files have been cleared and we can close the task.
stevemunene@cumin1003:~$ sudo cumin 'stat1*.eqiad.wmnet' 'ls /home/jly' 4 hosts will be targeted: stat[1008-1011].eqiad.wmnet OK to proceed on 4 hosts? Enter the number of affected hosts to confirm or "q" to quit: 4 ===== NO OUTPUT ===== PASS |█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 100% (4/4) [00:00<00:00, 7.84hosts/s] FAIL | | 0% (0/4) [00:00<?, ?hosts/s] 100.0% (4/4) success ratio (>= 100.0% threshold) for command: 'ls /home/jly'. 100.0% (4/4) success ratio (>= 100.0% threshold) of nodes successfully executed all commands.