652569 - Give RelEng access to tbpl.mozilla.org

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: General, task)

Description

[(no longer active)]

Currently, the only people who have access to tbpl.mozilla.org in order to deploy our changes live are me, Markus and Arpad (as far as I know).  The reason behind this is that we were the people who happened to be hacking on TBPL.  This situation needs to change.  I think we should give everybody on the RelEng team access to this server so that they can also deploy changes when something goes wrong (like the MozillaTry -> Try rename on Friday, see bug 651524).

Comment 1

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

This is important for RelEng as we add/edit/remove new branches. We already have access to do this on TinderboxServer - we need similar access to tbpl.m.o.

Who should this be assigned to? And is there any info needed to make this happen?

Comment 2

[Amy Rich [:arr] [:arich]]

Hey, Shyam, I presume that privs similar to 571551 need to happen here, and since you were point on that bug, I'll pass this one off to you.

Comment 3

[Shyam Mani [:fox2mike]]

Amy,

Box already allow access to anyone with an LDAP account. You can fix up sudoers in puppet and this should be good to go.

Comment 4

[Amy Rich [:arr] [:arich]]

John: We need a list of all of the POSIX usernames for people who will need sudo access.

Comment 5

[Nick Thomas [:nthomas] (UTC+12)]

Can we do this with the bit in LDAP which marks people as RelEng, and avoid having to keep sudoers up to date ? Maybe LDAP -> posix group, and use %<group> in sudoers ?

Comment 6

[Amy Rich [:arr] [:arich]]

(In reply to comment #5)
> Can we do this with the bit in LDAP which marks people as RelEng, and avoid
> having to keep sudoers up to date ? Maybe LDAP -> posix group, and use %<group>
> in sudoers ?

I think that's a fine solution.  It's an infra owned machine, so if you guys would like to make that modification, that would be great.  I don't know if you want to do something similar with the static entries that are already in the sudoers file.

Comment 7

[Nick Thomas [:nthomas] (UTC+12)]

I'm not sure how the LDAP -> group part is done, or much about our LDAP, so it makes sense for (some flavour) of IT to do that part IMO.

Comment 8

[Justin Dow [:jabba]]

since ldap-lpk is generally a Bad Idea[TM] for mission critical services, I'd be tempted to do have puppet create local accounts and manage sudoers manually...

Comment 9

[Chris AtLee [:catlee]]

While we're at it, can we make sure mstange gets his access back? new bug?

Comment 10

[Lukas Blakk [:lsblakk] use ?needinfo]

Adding a blocker to bug 652455 which will get instructions for how to use these new powers once we have them.

Comment 11

[Lukas Blakk [:lsblakk] use ?needinfo]

In case we need a list of people who need access because of not going the LDAP route the list would be:

[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]

and then mstange?

Comment 12

[Arpad Borsos [:Swatinem]]

As far as I know, I also have ldap/sudo access, but I was never able to actually connect to that machine because I was never granted access to the vpn. I think thats also Markus’ problem right now, I haven’t talked to him recently.

Comment 13

[Shyam Mani [:fox2mike]]

Amy,

I'm not sure why this is assigned to me again? What is specific in here that needs me to do it?

Comment 14

[Shyam Mani [:fox2mike]]

(In reply to comment #9)
> While we're at it, can we make sure mstange gets his access back? new bug?

Why can't he login? What's the error? More details please, or ask him to comment here.

Comment 15

[Shyam Mani [:fox2mike]]

(In reply to comment #5)
> Can we do this with the bit in LDAP which marks people as RelEng, and avoid
> having to keep sudoers up to date ? Maybe LDAP -> posix group, and use %<group>
> in sudoers ?

Sure. Since the bug was punted to me, I'm working on this (and discovered a bug with our system) but that shouldn't prevent sudo based on a group.

Comment 16

[Shyam Mani [:fox2mike]]

(In reply to comment #15)
> (In reply to comment #5)
> > Can we do this with the bit in LDAP which marks people as RelEng, and avoid
> > having to keep sudoers up to date ? Maybe LDAP -> posix group, and use %<group>
> > in sudoers ?

[root@dm-tbpl01 ~]# puppetd --test
info: Retrieving plugin
info: Loading facts in available_package_updates
info: Loading facts in hp_array_utils
info: Loading facts in available_package_updates
info: Loading facts in hp_array_utils
info: Caching catalog for dm-tbpl01.mozilla.org
info: Applying configuration version '13926'
--- /etc/sudoers	2010-10-12 02:54:53.000000000 -0700
+++ /tmp/puppet-file.10856.0	2011-04-27 05:37:06.000000000 -0700
@@ -39,3 +39,4 @@
 johnath         ALL=(ALL)       NOPASSWD: ALL
 dietrich        ALL=(ALL)       NOPASSWD: ALL
 aboros          ALL=(ALL)       NOPASSWD: ALL
+%releng			ALL=(ALL)		NOPASSWD: ALL
info: FileBucket adding {md5}73cec3ce2f37b27e0c08fde18ededde2
info: /Stage[main]/Sudo/File[sudoers]: Filebucketed /etc/sudoers to main with sum 73cec3ce2f37b27e0c08fde18ededde2
notice: /Stage[main]/Sudo/File[sudoers]/content: content changed '{md5}73cec3ce2f37b27e0c08fde18ededde2' to '{md5}5ea5696f849bceff47da31219c6b30fa'
notice: Finished catalog run in 11.02 seconds

Done. Anyone in releng except catlee (i'm using his account to fix the bug I discovered) should be able to sudo, can someone test and verify this please?

Comment 17

[Shyam Mani [:fox2mike]]

Well, I jumped into nthomas' account and verified too.

[root@dm-tbpl01 ~]# su - nthomas

[nthomas@dm-tbpl01 ~]$ ls -l /root/
ls: /root/: Permission denied

[nthomas@dm-tbpl01 ~]$ sudo ls -l /root/
total 56
-rw------- 1 root root  1125 Jun 20  2010 anaconda-ks.cfg
-rw-r--r-- 1 root root 14727 Jun 20  2010 install.log
-rw-r--r-- 1 root root  3044 Jun 20  2010 install.log.syslog
-rw-r--r-- 1 root root 15500 Jun 20  2010 post_install.log

Comment 18

[Zandr Milewski [:zandr]]

Logins work, but this is only accessible over MPT-VPN, not Build-VPN. Will discuss that with Ravi today.

Comment 19

[Nick Thomas [:nthomas] (UTC+12)]

(In reply to comment #17)
> Well, I jumped into nthomas' account and verified too.

You scoundrel!

I look forward to breaking tbpl some time soon. ;-)

Comment 20

[Shyam Mani [:fox2mike]]

(In reply to comment #19)
> (In reply to comment #17)
> > Well, I jumped into nthomas' account and verified too.
> 
> You scoundrel!

<3 

Figured I couldn't wait for someone to get online and test :p

> I look forward to breaking tbpl some time soon. ;-)

/me makes sure it doesn't page oncall :p