While you're at it, please also add him as a member of https://wikitech.wikimedia.org/wiki/Nova_Resource:Deployment-prep (see hints at https://wikitech.wikimedia.org/wiki/EventLogging/Testing/BetaLabs#Give_people_access)

And please also grant him access to caesium release server (add him to releasers-mobile), see similar request rOPUP90f0cc02f3a65995b0c8c44aabc37c9c4f6b9710.

Not a big deal, but I think this should be under user "niedzielski" since that's what I use for Gerrit.

@dr0ptp4kt: Care to place your imprimatur on this?

Approved.

@Niedzielski: Please post a SSH key you will use, and review and sign L3

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvAn78DE2Wj3QZFQSYe19eAqcGWZXQZA/TPuDjFtSdBU9yqsdcWUzfpN8ZN+dpvvQyBLbKf2MxYD2ghoo0WdUdcRoxB/7XyP5xsHLW4BRYtEf0XlPP9uC1C0ph+8KSdDkwSM9qEgHWnqZJQQQoiQkVed2cgv3/EeKuIQ84d5MxUjViQxARN5RP8fH/4Gr7BuhXcBfs7P8r8ZkJKT7VeKcTXFdWcP4uluyxK9TswrKhtdY/MHTIJPJSjGIQALl1mPLxSgJIbFADGbYNGf3ykimkeVbAoNkIH6IDe9CevEWMaexapKN2+hT3XnwWujHETScxp3mAzEr4JmGR2mQaCO3b stephen@niedzielski.com

Signed!

Change 209010 had a related patch set uploaded (by coren):
stat1002/1003 access for sniedzielski

https://gerrit.wikimedia.org/r/209010

@Ottomata: All clear from you, since this is a stats server?

In T97866#1253700, @bearND wrote:

While you're at it, please also add him as a member of https://wikitech.wikimedia.org/wiki/Nova_Resource:Deployment-prep (see hints at https://wikitech.wikimedia.org/wiki/EventLogging/Testing/BetaLabs#Give_people_access)

And please also grant him access to caesium release server (add him to releasers-mobile), see similar request rOPUP90f0cc02f3a65995b0c8c44aabc37c9c4f6b9710.

I'm going to move off that subrequest to a distinct ticket, as it does not involve the same production servers nor the same authorities.

All clear from me, but it is not clear what services are being asked for.

See:
https://wikitech.wikimedia.org/wiki/Analytics/Data_access#Access_Groups

In T97866#1261518, @Ottomata wrote:

All clear from me, but it is not clear what services are being asked for.

original request had "Similar task as T95506 but for a different user." so i interpreted that as "same as mholloway"

mholloway has "researchers" and "bastion-only" (and the releasers group handled in a separate task).

that matches coren's change and based on that I +1ed

Sounds good. researchers makes sense.

Change 209010 merged by Dzahn:
stat1002/1003 access for sniedzielski

https://gerrit.wikimedia.org/r/209010

@Ottomata thanks

@coren rebased and amended your change and merged

groups: researchers and bastiononly like for mholloway

@Niedzielski your account has been created on bast1001 and you should be able to login now.

on bast1001.wikimedia.org

Notice: /Stage[main]/Admin/Admin::Hashuser[niedzielski]/Admin::User[niedzielski]/File[/home/niedzielski/.ssh/authorized_keys]/ensure: created
Notice: /Stage[main]/Admin/Admin::Groupmembers[bastiononly]/Exec[bastiononly_ensure_members]/returns: executed successfully

I'm in! Thanks!

Hey @Dzahn. I apologize but this doesn't seem to be working for me at the moment and I'm not sure if it's on my end or the server. I can login to bast1001 and proxy to caesium fine. However, when trying to proxy from bast1001 to stat1002 / stat1003 my public key is denied. My SSH configuration looks like:

Host bast1001.wikimedia.org # ok
  User niedzielski

Host caesium.eqiad.wmnet # ok
  User niedzielski
  ProxyCommand ssh bast1001.wikimedia.org -W %h:%p

Host stat1002 # public key denied
  User niedzielski
  ProxyCommand ssh bast1001.wikimedia.org -W %h:%p

Any help would be appreciated. Thanks!

@Niedzielski Ohh, hi! Sorry, i didn't see this comment until the ticket was reopnened, so you did right.

First let me confirm that:

• on stat1003 you have a home directory and user, and yes, it is called "niedzielski"
• on stat1002 you do _not_ have a user

so that part would be about puppet admin groups and those servers having different roles

are you sure it doesn't work on stat1003? i don't see it in your ssh config above. try adding that like:

Host stat1003
  User niedzielski
  ProxyCommand ssh -W %h:%p niedzielski@bast1001.wikimedia.org

(note how the user name appears in 2 places for both connections)

then ssh stat1003.eqiad.wmnet and let me know if that works

@Dzahn, thanks! You're correct. My stat1003 configuration was bogus. stat1003 is good to go. Other than fixing my configuration, what do I need to do to get stat1002 working?

Do you need access to stat1002? If so, what do you need it for?

See this doc for clarification:
https://wikitech.wikimedia.org/wiki/Analytics/Data_access#Access_Groups

@Ottomata, @Dzahn, I just checked with my team and it sounds like stat1003 access is sufficient. Please consider this request resolved. Thanks for all the help!