1106577 - remove ssh access from cruncher to all masters (releng.{use1,usw2})

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: General, task)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

Cruncher is a general-use, low-security host, which has active connections to users' SSH agents and probably a few ssh private keys.  It shouldn't have access via SSH to all of the masters.

This is a pretty simple change to the buildbot-master SG.

Comment 1

[Justin Wood (:Callek)]

Let's talk about this during this week before this bug gets closed, there are more than just me doing reconfigs from Fincher

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

Callek couldn't remember what he meant when I went to talk to him .. so, please comment :)

Comment 3

[Justin Wood (:Callek)]

Ok, I still can't remember, so I'm no longer blocking --

 as long as Bug 1092871 c#7 gets addressed before the flow is cut.

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

Attachment: bug1106577-known_hosts.patch

Comment 5

[Justin Wood (:Callek)]

Comment on attachment 8534409 [details] [diff] [review]
bug1106577-known_hosts.patch

Review of attachment 8534409 [details] [diff] [review]:
-----------------------------------------------------------------

was under the impression you had some way to do this automatically, (e.g. if we ever reimage a master, or add new ones, I suspect we'll miss this) but that said, r+

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 8534409 [details] [diff] [review]
bug1106577-known_hosts.patch

https://hg.mozilla.org/build/puppet/rev/f87db0c03ce1

Comment 7

[Dustin J. Mitchell [:dustin] (he/him)]

Attachment: PR

Comment 8

[Dustin J. Mitchell [:dustin] (he/him)]

OK, deployed