infrastructure March 2016

infrastructure@lists.fedoraproject.org

42 participants
92 discussions

Retrospective Freeze Break Request: enable moderator group
by Patrick Uiterwijk 18 Mar '16

18 Mar '16

Hi, I had to apply the following patch to make Basset able to enable users: this removes the "if staging" conditional. Could I get +1s please? diff --git a/roles/fas_server/templates/fas.cfg.j2 b/roles/fas_server/templates/fas.cfg.j2 index 3f293dc..1c6bf8d 100644 --- a/roles/fas_server/templates/fas.cfg.j2 +++ b/roles/fas_server/templates/fas.cfg.j2 @@ -73,11 +73,7 @@ systemgroup = 'fas-system' # Valid action : # modo.allow.update_status, allow approved member to do related action. modo.group = 'accounts-moderators' -{% if env == "staging" %} modo.allow.update_status = True -{% else %} -modo.allow.update_status = False -{% endif %} # thirdpartygroup is for thirdparties that also need group management # via fas, but maintain their own actual account systems With kind regards, Patrick Uiterwijk Fedora Infra

3 2

Freeze Break Request: Try 2 on iptables block
by Stephen John Smoogen 18 Mar '16

18 Mar '16

So the block I wanted was too late in the process. Adding a new variable and a template to work with. -- Stephen J Smoogen.

3 2

Freeze break request: Block certain problematic rsync IPs
by Stephen John Smoogen 18 Mar '16

18 Mar '16

commit c83e3ef418abac30f3c25b93244150e138583c7d Author: Stephen Smoogen <smooge(a)redhat.com> Date: Fri Mar 18 19:26:37 2016 +0000 add in some rules. diff --git a/inventory/group_vars/download-phx2 b/inventory/group_vars/download-phx2 index 111eeca..e44d0e0 100644 --- a/inventory/group_vars/download-phx2 +++ b/inventory/group_vars/download-phx2 @@ -7,3 +7,5 @@ nrpe_procs_crit: 1000 # nfs mount options, overrides the all/default nfs_mount_opts: "ro,hard,bg,intr,noatime,nodev,nosuid,actimeo=600,nfsvers=3" + +custom_rules: [ '-A INPUT -s 143.106.60.118 -j DROP', '-A INPUT -s 143.106.60.112 -j DROP', '-A INPUT -s 169.53.165.245 -j DROP', '-A INPUT -s 46.29.92.6 -j DROP', '-A INPUT -s 198.11.167.9 -j DROP', '-A INPUT -s 103.193.116.147 -j DROP', '-A INPUT -s 69.47.68.211 -j DROP' ] -- Stephen J Smoogen.

3 2

Freeze break request: Enable Basset in FAS production
by Patrick Uiterwijk 18 Mar '16

18 Mar '16

Hi, After a lot of work and FBRs, we are finally ready to go live. Could I get +1s for the FBR attached to enable it in FAS? RFR: https://fedorahosted.org/fedora-infrastructure/ticket/5174 SOP: https://infrastructure.fedoraproject.org/infra/docs/basset.rst These documentations and the current Basset version are first versions. All will need finetuning to work correctly, but this will enable the FAS hooks.

3 4

Freeze break: iptables syncup
by Kevin Fenzi 18 Mar '16

18 Mar '16

Greetings. We have added a number of stg machines, which means that there are pending changes to all our phx2 prod machines (because they take that as a list to block). This means the daily check/diff report is at about 100kb or so and it's hard to see any changes that might be important. I'd like to run: ansible-playbook master.yml -t iptables and sync things up. This should update those hosts with the new staging instances and restart iptables. I don't really expect any problem with it as we have done this a number of times in the past with no issue. The changes for a phx2 host would typically be something like the below check/diff. +1s? kevin -- --- before: /etc/sysconfig/iptables +++ after: dynamically generated @@ -1,11 +1,11 @@ -# Ansible managed: /srv/web/infra/ansible/roles/base/templates/iptables/iptables modified on 2016-01-08 16:33:00 by root on batcave01.phx2.fedoraproject.org +# Ansible managed: /srv/web/infra/ansible/roles/base/templates/iptables/iptables modified on 2016-03-10 20:24:35 by root on batcave01.phx2.fedoraproject.org *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] # allow ping and traceroute -A INPUT -p icmp -j ACCEPT # localhost is fine -A INPUT -i lo -j ACCEPT @@ -40,20 +40,22 @@ # autocloud-backend02.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.126 -j REJECT --reject-with icmp-host-prohibited # autocloud-web01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.3 -j REJECT --reject-with icmp-host-prohibited # autocloud-web02.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.89 -j REJECT --reject-with icmp-host-prohibited # badges-backend01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.68 -j REJECT --reject-with icmp-host-prohibited # badges-web01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.69 -j REJECT --reject-with icmp-host-prohibited +# basset01.stg.phx2.fedoraproject.org +-A INPUT -s 10.5.126.138 -j REJECT --reject-with icmp-host-prohibited # beaker-stg01.qa.fedoraproject.org -A INPUT -s 10.5.124.141 -j REJECT --reject-with icmp-host-prohibited # blockerbugs01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.65 -j REJECT --reject-with icmp-host-prohibited # bodhi-backend01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.90 -j REJECT --reject-with icmp-host-prohibited # bodhi02.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.169 -j REJECT --reject-with icmp-host-prohibited # bugyou01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.130 -j REJECT --reject-with icmp-host-prohibited @@ -72,20 +74,22 @@ # darkserver-web02.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.120 -j REJECT --reject-with icmp-host-prohibited # datagrepper01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.67 -j REJECT --reject-with icmp-host-prohibited # db-fas01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.78 -j REJECT --reject-with icmp-host-prohibited # db01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.204 -j REJECT --reject-with icmp-host-prohibited # db03.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.113 -j REJECT --reject-with icmp-host-prohibited +# docker-registry01.stg.phx2.fedoraproject.org +-A INPUT -s 10.5.126.217 -j REJECT --reject-with icmp-host-prohibited # elections01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.105 -j REJECT --reject-with icmp-host-prohibited # fas01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.86 -j REJECT --reject-with icmp-host-prohibited # fedimg01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.9 -j REJECT --reject-with icmp-host-prohibited # fedocal01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.66 -j REJECT --reject-with icmp-host-prohibited # gallery01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.70 -j REJECT --reject-with icmp-host-prohibited @@ -120,20 +124,22 @@ # notifs-backend01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.75 -j REJECT --reject-with icmp-host-prohibited # notifs-web01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.48 -j REJECT --reject-with icmp-host-prohibited # notifs-web02.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.109 -j REJECT --reject-with icmp-host-prohibited # nuancier01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.202 -j REJECT --reject-with icmp-host-prohibited # nuancier02.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.203 -j REJECT --reject-with icmp-host-prohibited +# osbs-master01.stg.phx2.fedoraproject.org +-A INPUT -s 10.5.126.216 -j REJECT --reject-with icmp-host-prohibited # packages03.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.42 -j REJECT --reject-with icmp-host-prohibited # paste01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.61 -j REJECT --reject-with icmp-host-prohibited # pdc-backend01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.135 -j REJECT --reject-with icmp-host-prohibited # pdc-web01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.133 -j REJECT --reject-with icmp-host-prohibited # pkgdb01.stg.phx2.fedoraproject.org -A INPUT -s 10.5.126.20 -j REJECT --reject-with icmp-host-prohibited

3 2

Freeze break request: add Basset monitoring
by Patrick Uiterwijk 18 Mar '16

18 Mar '16

Can I get +1s to apply the following Nagios monitoring to the Nagios server and basset01?

3 3

Freeze break: epylog rules update for log01
by Kevin Fenzi 18 Mar '16

18 Mar '16

Greetings. I'd like to weed out some anoying high volume messages from epylog reports. diff --git a/roles/epylog/files/merged/weed_local.cf b/roles/epylog/files/merged/weed_local.cf index 60613c8..83aae40 100644 --- a/roles/epylog/files/merged/weed_local.cf +++ b/roles/epylog/files/merged/weed_local.cf @@ -231,6 +231,7 @@ rsyncd.*: name lookup failed for.* rsyncd.*: rsync: connection unexpectedly closed.* rsyncd.*: rsync error: error in rsync protocol data stream.* rsyncd.*: sent.* +rsyncd.*: rsync: change_dir.*failed.* #rsync.*: rsync on.* rsyslogd-2163:epoll_ctl failed #goofy-ass rsyslogd error :( @@ -292,6 +293,8 @@ sshd.*: Disconnecting: Too many authentication failures.* sshd.*: Disconnected from.* sshd.*: Read error from remote host.* sshd.*: error: maximum authentication attempts exceeded for.* +sshd.*: Close session.*user root from 10.5.126.23 port 60755 id 0 +sshd.*: error: key_read: uudecode.*failed stunnel:.*connected remote.* stunnel:.*SSL_read.* stunnel:.*Connection reset.* +1s? kevin

3 2

Can't login into wiki
by Ronit Halder 18 Mar '16

18 Mar '16

Hi, when i want to login into fas or wiki with my acc Leoryk i get error message: Login error You have entered an invalid username and password. If you are certain that your username and password are correct, confirm that you can log in to the Fedora Account System (https://admin.fedoraproject.org/accounts/) and that you have signed the CLA. even if i reset my password. What can i do? I am unable to submit my Gsoc proposal regards, Ronit

2 3

Freeze break request: Upgrade FAS to 0.12.0 and open firewall on db-fas01 from basset01
by Patrick Uiterwijk 17 Mar '16

17 Mar '16

Hi, Could I get +1s for the following things: 1. Upgrade FAS to 0.12.0: this release includes hooks for spam checks, and is currently running in Staging. 2. Installation of basset01.phx2 prod (not per se freeze break as it's a new host). 3. Open the db-fas01 prod firewall for basset01.phx2 (see patch) so that it can import the prod data. Note that this specifically does not include updating the FAS config to make use of the Basset calls, I will open a new FBR when I'm ready for that. This means that for the time being, there should be no visible changes to FAS until we enable this. I could hold off on the FAS upgrade until we are ready, but I figured I could get it done now. (if I can get at least +1s for nr 2/3, I can get started). [master 36bd988] Enable access from basset01 to db-fas01 1 file changed, 3 insertions(+) [puiterwijk@batcave01 host_vars]$ git show HEAD commit 36bd9884fc2a846ebc784713be8d88a5c555018a Author: Patrick Uiterwijk <puiterwijk(a)redhat.com> Date: Thu Mar 17 21:20:58 2016 +0000 Enable access from basset01 to db-fas01 Signed-off-by: Patrick Uiterwijk <puiterwijk(a)redhat.com> diff --git a/inventory/host_vars/db-fas01.phx2.fedoraproject.org b/inventory/host_vars/db-fas01.phx2.fedoraproject.or index 83372cc..00b6fb1 100644 --- a/inventory/host_vars/db-fas01.phx2.fedoraproject.org +++ b/inventory/host_vars/db-fas01.phx2.fedoraproject.org @@ -37,6 +37,9 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.5.126.46 --dport 5432 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.5.126.47 --dport 5432 -j ACCEPT' , + # basset01 + '-A INPUT -p tcp -m tcp -s 10.5.126.194 --dport 5432 -j ACCEPT', + # sundries02... '-A INPUT -p tcp -m tcp -s 10.5.126.41 --dport 5432 -j ACCEPT', With kind regards, Patrick Uiterwijk Fedora Infra

5 4

Freeze break request: Update wiki captcha settings
by Patrick Uiterwijk 17 Mar '16

17 Mar '16

Hi, Per request of Adam Williamsion (discussion about ticket #5140), I would like to disable captchas for logged in people. At the same time, I'm also disabling the on-login captcha that stopped the spam cleanup script from working at times of heavy spam. Could I get +1s, or would people suggest to wait with this?

4 6

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure March 2016