Page MenuHomePhabricator

Create a proper way to ban a user from PAWS
Open, Needs TriagePublic

Description

Recently many "Server didn't respond in 30 seconds" tasks are reported in Phabricator (T398087, T410712, T410833, T410837, T431744, T431914). Some (probably not all) are caused by managers of PAWS handling suspicious activity. Such way to handle suspicious accounts is a hack, since (1) This make users confused (this is why such task are filed here) and (2) This buries potential actual server bug needs fixing.

Instead, we need a proper way to handle suspicious accounts, i.e. users affected should clearly know their account is banned.

There is a real bug buried in the tide of noise here - PAWS should report the error to the user better. That is, if a user's homedir is locked it should say "You been banned from using PAWS. Contact <somewhere> if this is in error", rather than hanging indefinitely.

Event Timeline

Agree. As an fyi. there was a peak of misuse and we agreed (in the team meeting) to do the quick block now and try to be responsive for the tasks that might arise until we can properly focus the resources to build/fix/improve the current processes.

Agree. As an fyi. there was a peak of misuse and we agreed (in the team meeting) to do the quick block now and try to be responsive for the tasks that might arise until we can properly focus the resources to build/fix/improve the current processes.

As you said too, at least one of them so far was not because of this action, but because NFS ran out of space (that we have been also trying to manage, probably related to the peak of misuse). Thanks for keeping an eye too btw.

Note to we need to delete files made by banned users automatically (otherwise user can bloat NFS usage via creating multiple accounts) - and this should retroactively be done for previously banned users, but we may still want to give some time so user can appeal.

Note to we need to delete files made by banned users automatically (otherwise user can bloat NFS usage via creating multiple accounts) - and this should retroactively be done for previously banned users, but we may still want to give some time so user can appeal.

We discussed this internally yesterday, and for the file deletion, there's a separate task: T432251

The 30 days grace period before deleting files from locked out users is intended to be this grace period.