The #security-team recently reviewed membership of [[ https://gerrit.wikimedia.org/r/plugins/gitiles/operations/puppet/+/refs/heads/production/modules/admin/data/data.yaml#66 | the Wikimedia deployment group ]]. We validated a few things such as affiliation (WMF, WMDE) a valid NDA on file with #wmf-legal and the last date an individual performed a deploy according to [[ https://wikitech.wikimedia.org/wiki/Server_Admin_Log | the SAL and archives ]]. These results are partially generated by a python script (soon to live within [[ https://gerrit.wikimedia.org/g/wikimedia/security/tooling/+/refs/heads/master | wikimedia/security/tooling ]]) and exist within [[ https://docs.google.com/spreadsheets/d/1468W4xFRopNQCz4PRlan9i89F-bKjU3FjQGuVcSNQq8 | a protected Google sheet ]]. The following is a subset of the aforementioned results and includes users who have not performed a deploy within the last two years. The #security-team believes that if these individuals do not regularly perform deploys and are unlikely to do so any time in the future, we should remove their deployment rights, given the sensitivity and power of such rights. Some of these users (e.g. Kevina Bazira) very recently received these rights and should not be considered within this discussion.
| Shell username | Name | WMF | WMDE | WMF Legal NDA? | Last Deployed
| --- | --- | --- | --- | --- | --- | ---
| alaasarhan | Alaa Sarhan | 0 | 1 | 1 | No deploys last 2 years
| andrew-wmde | Andrew Kostka | 0 | 1 | 1 | No deploys last 2 years
| aude | Katie Filbert (former WMDE) | 0 | 0 | 1 | No deploys last 2 years
| awjrichards | Arthur Richards | 1 | 0 | 1 | No deploys last 2 years
| daniel | Daniel Kinzler | 1 | 0 | 1 | No deploys last 2 years
| dr0ptp4kt | Adam Baso | 1 | 0 | 1 | No deploys last 2 years
| dsharpe | David Sharpe | 1 | 0 | 1 | No deploys last 2 years
| esanders | Ed Sanders | 1 | 0 | 1 | No deploys last 2 years
| jdl | Jason David Linehan | 1 | 0 | 1 | No deploys last 2 years
| jfishback | James Fishback | 1 | 0 | 1 | No deploys last 2 years
| kevinbazira | Kevina Bazira (scoring team) | 1 | 0 | 1 | No deploys last 2 years
| wmde-fisch | Christoph Jauera | 0 | 1 | 1 | No deploys last 2 years
| wmde-leszek | Leszek Manicki | 0 | 1 | 1 | No deploys last 2 years
@MoritzMuehlenhoff - do you or anyone else in SRE have any opinions on this? The #security-team would like to perform this audit and make any necessary access adjustments on a quarterly basis.