Page MenuHomePhabricator

define in Puppet or remove user account - milimetric
Closed, ResolvedPublic

Description

@Milimetric

We're in the process of auditing and cleaning up our access lists to servers. During this audit, we found your user in place on a few sysetms, without having admin module entries. We need to review these systems and confirm you still require access to them, and why. Since we don't have this on record or in puppet, we'll have to go through the normal approval process. As such, please simply have your manager approve on this task which systems you confirm you need to continue to access.

stat1001.eqiad.wmnet:

Please note what you need to do on each system, as we'll need to ensure you maintain the proper access levels when we add you to the admins module.

Feedback is required, as we'll be removing the access of anyone we don't account for during this audit.

Thanks in advance,

Event Timeline

RobH assigned this task to Milimetric.
RobH raised the priority of this task from to High.
RobH updated the task description. (Show Details)
RobH added subscribers: Tnegrin, Milimetric.

Thanks for the ping @RobH. I only need basic access to stat1001, no sudo or special access. I am a member of the analytics team and thus need to be able to look at what people are doing on that machine if they point me to something there.

@Milimetric,

I'm not 100% which group we'd put you in then, sorry for the back and forth.

On stat1001 I see a group for statistics-web-users, which includes: ezachte, qchris, joal. This group has the note access for stats.wikimedia.org. Is this the level of access you needed?

If so, I'll make the changes and we can get your managers approval on this task to formalize it.

Please advise,

@RobH, yes, the statistics-web-users group is perfectly fine. I'm the one who's sorry I didn't know to tell you in the first place. Thanks again.

@Tnegrin,

Would you please comment on this task to approve that @Milimetric can be added to statistics-web-users group, which formalizes his access to stat1001.

This came up due to our audit of user accounts, and it seems his account wasn't properly setup for stat1001. So he has access now, and will keep it with your approval.

Thanks in advance,

https://gerrit.wikimedia.org/r/#/c/193396/ is the patchset for this change, once we have Toby's approval.

@Tnegrin one more approval is needed here please

https://gerrit.wikimedia.org/r/#/c/193396/ is the patchset for this change, once we have Toby's approval.

@Tnegrin thanks! merged

@RobH if you put "Bug:T90956" instead of just "T90956" in the commit message the bot will automatically update the ticket on upload and merge

@Milimetric nothing should have changed on stat1001. this just let puppet manage your existing key, but it's good that it's formalized now and installed with configuration management. i saw puppet replace it and technically the checksum of your key file changed, but that was just about a newline that is now gone

Dzahn claimed this task.