619530 - please allow jimm to be part of the build-vpn

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps, task)

Description

[Aki Sasaki (not active)]

I'm not sure if he has MV-vpn; if not, he'll need a firewall port opened.

Comment 1

[Phong Tran [:phong]]

Is this mini located at the office?  If he is a mozilla employee, then he should already have access to MV-VPN.

Comment 2

[Armen [:armenzg]]

Most minis (if not all) are in SCL.
This is neither MPT-VPN nor MV-VPN AFAICT.

He has to be able to reach that machine on the Build-VPN through VNC.

Comment 3

[Aki Sasaki (not active)]

Jimm remembers setting up MV vpn at some point; I've pointed him at the VPN wiki page. I'll close this.

Comment 4

[Aki Sasaki (not active)]

It's in scl1. I can get to it from the office, but Jim can't get to it when ssh tunneling into MV vpn.
Reopening.

Comment 5

[Armen [:armenzg]]

Bumping the priority.
Anyone can take this on?

Comment 6

[matthew zeier [:mrz]]

The route for SCL1 isn't pushed to the Mountain View VPN.  It shouldn't either - the whole build-vpn project's goal is to limit access to RelEng hosts to just the build-vpn host.

More easier to add him to the build-vpn for whatever duration he needs.

Comment 7

[Jim Mathies [:jimm]]

(In reply to comment #6)
> The route for SCL1 isn't pushed to the Mountain View VPN.  It shouldn't either
> - the whole build-vpn project's goal is to limit access to RelEng hosts to just
> the build-vpn host.
> 
> More easier to add him to the build-vpn for whatever duration he needs.

About a week or so. Maybe less. I'm investigating why shell tests run so slowly on these machines.

Comment 8

[Phong Tran [:phong]]

can someone from releng ack giving access to build-vpn?

Comment 9

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

(In reply to comment #8)
> can someone from releng ack giving access to build-vpn?

ack. Once jimm is done with this experiment, we need to revoke this.

(working offline with zandr to confirm what is the "usual" process IT want to follow for "dev need access to build system" problems going forward)

Comment 10

[Phong Tran [:phong]]

added.

Comment 11

[matthew zeier [:mrz]]

(going forward we'll use an SSL VPN to handle things like this but we don't have it online yet)

Comment 12

[Armen [:armenzg]]

Changing summary to match the actual action that took place.

I filed bug 622819 to revoke the access when his work is done.
I will pass it to ServOps once the work is done.

Comment 13

[[e-mail] (:bhearsum)]

(In reply to comment #11)
> (going forward we'll use an SSL VPN to handle things like this but we don't
> have it online yet)

Anywhere we can track the status of this?

Comment 14

[matthew zeier [:mrz]]

Bug 622210.