1140214 - Make pash.py's root login code path clean

Status: RESOLVED FIXED

(Developer Services :: Mercurial: hg.mozilla.org, defect)

Description

[Gregory Szorc [:gps]]

pash.py has a number of vectors where *all* SSH logins can be locked out. If any of these were to happen in production, we'd be in deep trouble. Let's refactor it so the root login code path is robust.

Comment 1

[Gregory Szorc [:gps]]

Attachment: MozReview Request: bz://1140214/gps

/r/4921 - pash: consistently format pash.py
/r/4923 - pash: store user in a variable
/r/4925 - pash: move QuoteForPOSIX into pash.py
/r/4927 - pash: move non-root login code path to isolated function (bug 1140214)

Pull down these commits:

hg pull review -r 1c6e1f3e23a6acd169dd11521f90a7ce7aa99016

Comment 2

[Gregory Szorc [:gps]]

Comment on attachment 8573647 [details]
MozReview Request: bz://1140214/gps

/r/4921 - pash: consistently format pash.py
/r/4923 - pash: store user in a variable
/r/4925 - pash: move QuoteForPOSIX into pash.py
/r/4927 - pash: move non-root login code path to isolated function (bug 1140214)
/r/4929 - pash: remove hg.ecmascript.org support

Pull down these commits:

hg pull review -r 2eb2296b18091d93b606b3a8ad8ea41ae1fac9d5

Comment 3

[Gregory Szorc [:gps]]

Comment on attachment 8573647 [details]
MozReview Request: bz://1140214/gps

/r/4921 - pash: consistently format pash.py
/r/4923 - pash: store user in a variable
/r/4925 - pash: move QuoteForPOSIX into pash.py
/r/4927 - pash: move non-root login code path to isolated function (bug 1140214)
/r/4929 - pash: remove hg.ecmascript.org support
/r/4959 - pash: replace doc_root with DOC_ROOT

Pull down these commits:

hg pull review -r 851a9a9422cca2c41b835e484d1c5960cc97d0a1

Comment 4

[Ben Kero [:bkero]]

https://reviewboard.mozilla.org/r/4921/#review4041

Ship It!

Comment 5

[Ben Kero [:bkero]]

https://reviewboard.mozilla.org/r/4923/#review4043

Ship It!

Comment 6

[Ben Kero [:bkero]]

https://reviewboard.mozilla.org/r/4925/#review4045

Ship It!

Comment 7

[Ben Kero [:bkero]]

https://reviewboard.mozilla.org/r/4927/#review4047

Ship It!

Comment 8

[Ben Kero [:bkero]]

https://reviewboard.mozilla.org/r/4929/#review4049

Ship It!

Comment 9

[Ben Kero [:bkero]]

https://reviewboard.mozilla.org/r/4959/#review4051

Ship It!

Comment 10

[Ben Kero [:bkero]]

Comment on attachment 8573647 [details]
MozReview Request: bz://1140214/gps

https://reviewboard.mozilla.org/r/4919/#review4053

Ship It!

Comment 11

[Gregory Szorc [:gps]]

https://hg.mozilla.org/hgcustom/version-control-tools/rev/a61eb8576df9

Comment 12

[Peter Radcliffe [:pir]]

A change listed to here backed out a change I made in bug 1116796, accidentally or otherwise.

http://tinyurl.com/2aveg9k points to a component that is going away shortly. It should point to http://tinyurl.com/njcfhma

sysadmins/puppet/trunk/modules/hg_new/files/pash/pash.py:
------------------------------------------------------------------------
r101780 | [e-mail] | 2015-03-09 21:21:58 +0000 (Mon, 09 Mar 2015) | 2 lines

hg_new: update pash.py, bugfixes for 1140214

------------------------------------------------------------------------
r101721 | [e-mail] | 2015-03-09 12:10:57 +0000 (Mon, 09 Mar 2015) | 1 line

move tinyurl for bug creation to infra & ops :: moc: service requests. bug 116796
------------------------------------------------------------------------

Comment 13

[Gregory Szorc [:gps]]

pash changes deployed to prod by bkero.

Comment 14

[Ben Kero [:bkero]]

Sorry, I guess we had a merge conflict that I missed. Added the changed URL to pash.py. Deploying now.

Comment 15

[Peter Radcliffe [:pir]]

Thanks!

Comment 17

[Gregory Szorc [:gps]]

Attachment: MozReview Request: pash: remove hg.ecmascript.org support

Comment 18

[Gregory Szorc [:gps]]

Attachment: MozReview Request: pash: move non-root login code path to isolated function (bug 1140214)

Comment 19

[Gregory Szorc [:gps]]

Attachment: MozReview Request: pash: consistently format pash.py

Comment 20

[Gregory Szorc [:gps]]

Attachment: MozReview Request: pash: store user in a variable

Comment 21

[Gregory Szorc [:gps]]

Attachment: MozReview Request: pash: move QuoteForPOSIX into pash.py

Comment 22

[Gregory Szorc [:gps]]

Attachment: MozReview Request: pash: replace doc_root with DOC_ROOT