Meeting Log - 2008-03-13
by Ricky Zhou
16:01 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Meeting, who's here?
16:02 < ivazquez> Pong.
16:02 * nirik lurks in the background
16:02 -!- jmtaylor [n=jason(a)c-76-112-119-170.hsd1.mi.comcast.net] has joined #fedora-meeting
16:02 < mmcgrath> jmtaylor: yo, just getting started
16:03 < mmcgrath> skvidal: dgilmore: ping
16:03 -!- kambiz [n=kambiz(a)vorlon.oit.duke.edu] has joined #fedora-meeting
16:03 < skvidal> yah
16:03 < skvidal> in and out
16:03 * mmcgrath thinks RDU and Boston are having problems and pycon is going on right now so its quite possible lots of people won't be here today
16:03 * whitenoise 's around :P
16:03 < jmtaylor> mmcgrath: cool
16:04 < mmcgrath> alrighty, well we'll get started just the same
16:04 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- tickets
16:04 < mmcgrath> .tiny https://fedorahosted.org/fedora-infrastructure/query?status=new&status=as...
16:04 < zodbot> mmcgrath: http://tinyurl.com/2hyyz6
16:05 < mmcgrath> .ticket 421
16:05 < zodbot> mmcgrath: #421 (Fedora Mirror Space) - Fedora Infrastructure - Trac - https://fedorahosted.org/projects/fedora-infrastructure/ticket/421
16:05 * dgilmore is here
16:05 < mmcgrath> AFAIK f13's handling the actual pushing of those bits around
16:05 < mmcgrath> f13: you here?
16:05 * mmcgrath guesses not
16:05 < jwb> he's missing at the moment
16:06 -!- ezq [n=ezq(a)host83.190-224-57.telecom.net.ar] has quit "leaving"
16:06 < mmcgrath> either way I think thats mostly taken care of, I'll remove the meeting tag from it.
16:06 -!- J5 [n=quintice@nat/redhat/x-16fc084f9202d358] has joined #fedora-meeting
16:06 -!- J5 [n=quintice@nat/redhat/x-16fc084f9202d358] has quit Client Quit
16:06 * ricky is here for ~5 minutes
16:06 < mmcgrath> ricky: yo
16:06 -!- J5 [n=quintice@nat/redhat/x-151d921351e45e15] has joined #fedora-meeting
16:06 < mmcgrath> jcollie isn't here so we'll skip ticket 395
16:06 < mmcgrath> .ticket 398
16:06 < zodbot> mmcgrath: #398 (elfutils `monotone' (mtn) error) - Fedora Infrastructure - Trac - https://fedorahosted.org/projects/fedora-infrastructure/ticket/398
16:07 < mmcgrath> not much new here, I submitted a bug upstream and they claim there's lots of ways to do what we suggest, none of which are very good.
16:07 < mmcgrath> so I'm keeping an eye on that but I haven't actually looked to implement anything and I don't think anyone else has either
16:07 < mmcgrath> so moving on
16:07 < mmcgrath> .ticket 446
16:07 < zodbot> mmcgrath: #446 (Possibility to add external links on spins page) - Fedora Infrastructure - Trac - https://fedorahosted.org/projects/fedora-infrastructure/ticket/446
16:07 < mmcgrath> this is a new one from today.
16:08 -!- abadger1999 [i=3ffaf10a(a)gateway/web/ajax/mibbit.com/x-cec616d81473dc45] has joined #fedora-meeting
16:08 < mmcgrath> I've got to be honest, I'm not to keen on this idea of linking to other places for stuff. It feels hackish and silly.
16:08 < mmcgrath> having said that, the spins policies aren't set in stone yet so the fr people don't have many options.
16:08 < mmcgrath> So reluctantly we may have to allow this through.
16:08 * glezos is around if needed
16:08 < mmcgrath> glezos: howdy
16:09 < mmcgrath> does anyone have any comments or questions about htat?
16:09 < mmcgrath> it will take some code changes on our spins page.
16:09 < ivazquez> What happens if the policy comes down that external links are not allowed, after we've placed it?
16:09 < mmcgrath> then we'll remove it.
16:09 < mmcgrath> I'll send a feeler to the FAB now as it will likely take us a little bit to get the scripts in order anyway
16:10 < mmcgrath> well, I would if I could get to my mailbox.
16:10 * mmcgrath makes post-it note
16:10 < ivazquez> Has this been posed to the people handling the spins policies?
16:10 < mmcgrath> ivazquez: nope, they've been discussing it on the fab though.
16:11 < mmcgrath> so they'll comment when I send the feeler.
16:12 < mmcgrath> skvidal: any word on the new spins box? I know you've been busy this week with yum stuff.
16:12 < dgilmore> id rather not link outside
16:12 < ivazquez> Likewise.
16:12 < skvidal> mmcgrath: I'm waiting to make sure it stays up :)
16:12 < skvidal> it's been 7 days
16:13 < skvidal> I just want to make sure it's not keeling over like it was before
16:13 < skvidal> then we can move forward w/it
16:13 < mmcgrath> solid
16:13 < mmcgrath> Ok, moving on from tickets
16:13 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- FAS2
16:14 < dgilmore> woohoo
16:14 < mmcgrath> So fas2 shipped, its been doing fine. we had an issue yesterday but couldn't trace it to fas specifically, just strangeness in the db connections filling up mostly with koji requests and the old account system.
16:14 < mmcgrath> could have been a migration bug
16:14 < ricky> Aww, I'm going to miss part of this :(
16:14 -!- abadger1991 [n=abadger1(a)63.250.241.10] has joined #fedora-meeting
16:15 < dgilmore> fas2 seems to have been recieved really well
16:15 < mmcgrath> ricky: no worriesl
16:15 < mmcgrath> all in all things went well, there's still a few outstanding issues, fedorapeople being one of them right now.
16:16 < dgilmore> mmcgrath: whats up with fedorapeople?
16:17 < mmcgrath> dgilmore: well the nssdb is messed up so no one hsa accounts on it.
16:17 < dgilmore> :( thats not fun
16:17 < dgilmore> so we have someone with local access fixing?
16:17 < mmcgrath> its a pretty easy thing to fix but a security 'feature' in fas is preventing me from doing it :)
16:17 < mmcgrath> dgilmore: I can still get i nand with a shell, its just this pesky meeting got in the way of me fixing it :)
16:18 -!- till__ [n=till(a)genius.kawo2.RWTH-Aachen.DE] has joined #fedora-meeting
16:18 < dgilmore> mmcgrath: i see so its not a big deal then
16:18 < mmcgrath> not a big deal.
16:18 < mmcgrath> just lots of little things here and there.
16:18 < dgilmore> one question i have with fas2 is setting up sandboxes
16:18 < mmcgrath> big thanks goes out to ricky and toshio.
16:18 < mmcgrath> dgilmore: shoot
16:19 < dgilmore> say i put up a sparc box like fedorapeople.org where contributors get ssh and mock access
16:19 < dgilmore> id rather tie it into fas
16:19 < skvidal> dgilmore: mock? you sure?
16:19 < stickster> mmcgrath: I hope to have final word to you soon on CLA stuff
16:19 < dgilmore> im sure dwmw2_gone would want to do the same for his ppc64 box
16:19 -!- tyll [n=till(a)genius.kawo2.RWTH-Aachen.DE] has quit Nick collision from services.
16:20 < mmcgrath> stickster: excellent.
16:20 < stickster> mmcgrath: The relevant legal eagle just got back to the office today after being gone a bit.
16:20 < dgilmore> skvidal: to all people to test builds on sparc
16:20 < mmcgrath> dgilmore: yeah, I've thought about this, jesse has a similar box in question.
16:20 < dgilmore> to allow
16:20 < mmcgrath> dgilmore: so here's the thing. In general I'd like to allow third parties to be able to access fas. I'm going to write up some guidelines first for us all to go over.
16:20 < mmcgrath> The main concerns being...
16:20 < mmcgrath> 1) password harvesting
16:20 < dgilmore> skvidal: not mock on fedorapeople but same set of accounts
16:20 < mmcgrath> 2) password harvesting :)
16:21 < mmcgrath> and the problem with mock is it allows you to get root on the box.
16:21 < dgilmore> mmcgrath: id be happy disabling password auth and only allowing ssh
16:21 -!- till__ is now known as tyll
16:21 < dgilmore> mmcgrath: i.e put in something fake for a passwd
16:21 < mmcgrath> dgilmore: but if someone ssh'd and forwarded their key there's still issues there.
16:22 < dgilmore> mmcgrath: true
16:22 < mmcgrath> so the anwser is yes, I'd like to do something like that.
16:23 < mmcgrath> but I'm not sure the right way to go about it at this time.
16:23 < mmcgrath> I suspect a good answer will be for users to somehow get temporary passwords setup and emaild to them from that box.
16:23 < mmcgrath> and disallowing key based auth.
16:23 < mmcgrath> we can talk more about that later.
16:24 < mmcgrath> and there's lesser levels of integration I'd like to be able to just offer without much effort to people, like the fedora unity folks, who may want to get group information.
16:24 < dgilmore> that could be a possibily
16:24 < mmcgrath> anyone have any other questions?
16:24 -!- sereinity [n=sereinit(a)mon69-3-82-235-39-70.fbx.proxad.net] has joined #fedora-meeting
16:24 < mmcgrath> alllrighty
16:25 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Me won't be here for much longer this month.
16:25 < mmcgrath> This is a notice to everyone.
16:25 < mmcgrath> I'm goin gto be gone, pretty much the rest of the month
16:25 < jeremy_> mmcgrath: that's not allowed!
16:25 < mmcgrath> either at pycon, training or in vegas towards the end of the month
16:25 < mmcgrath> jeremy_: but but but vegas!!!!
16:25 < jeremy_> mmcgrath: work!
16:25 < jeremy_> back to it!
16:25 -!- wwoods [n=wwoods@nat/redhat/x-4a06e36cb94bc1b3] has joined #fedora-meeting
16:25 -!- cra [n=cra(a)about/networking/255.255.255.4/cra] has joined #fedora-meeting
16:25 -!- gregdek [n=gdk@nat/redhat/x-e254f54b8dd98d7c] has joined #fedora-meeting
16:25 < mmcgrath> so I'll be peaking my head in, and checking my email. But during the day I'll largely be gone
16:26 -!- poelcat_ [n=poelcat@fedora/poelcat] has joined #fedora-meeting
16:26 * mmcgrath sees RDU is back online
16:26 < mmcgrath> so thats that really.
16:26 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Open Floor
16:26 < mmcgrath> who's got something else they'd like to discuss?
16:27 < dgilmore> how has xen2 been holding up
16:27 < mmcgrath> dgilmore: good question.
16:27 < mmcgrath> So xen2
16:27 * mmcgrath finds the bz number
16:27 < mmcgrath> .bug 429469
16:27 < buggbot> Bug https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=429469 low, low, rc, Mike Christie, NEW , Frequent reboots of servers after upgrading to RHEL5.
16:27 < zodbot> mmcgrath: Bug 429469: Frequent reboots of servers after upgrading to RHEL5. - https://bugzilla.redhat.com/429469
16:27 < mmcgrath> so this one bit us hard.
16:27 < mmcgrath> During the trouble shooting late last week I disabled all iscsi based guests.
16:28 < mmcgrath> either converting them to local disk or moving them somewhere else.
16:28 < mmcgrath> This seems to have stopped the box from rebooting.
16:28 < mmcgrath> *however*
16:28 < mmcgrath> xen1 rebooted on... monday I want to say.
16:28 < mmcgrath> and it took on 2 guests from xen2, noc1 and app4 I believe.
16:28 -!- poelcat_ [n=poelcat@fedora/poelcat] has quit Client Quit
16:28 < mmcgrath> so its possible one of those guests wsa causing problems.
16:28 < mmcgrath> its possible it was a fluke.
16:28 < mmcgrath> but we're keeping an eye on it just the same.
16:29 < mmcgrath> needless to say, xen2's been pretty solid all week.
16:29 -!- jeremy_ [n=katzj(a)MUCKLEY-THREE-NINETY-NINE.MIT.EDU] has quit "back to the other client"
16:29 < mmcgrath> so thats the latest on that
16:29 < mmcgrath> Anyone have anything else they'd like to discuss?
16:31 < gkrpan> <-- looking into the RFR process. Nothing to report on it yet.
16:31 < mmcgrath> gkrpan: solid
16:31 < mmcgrath> ok, well we'll close the meeting in 30
16:31 -!- abadger1999 [i=3ffaf10a(a)gateway/web/ajax/mibbit.com/x-cec616d81473dc45] has quit "http://www.mibbit.com ajax IRC Client"
16:31 -!- jlaska [n=jlaska@nat/redhat/x-2b60db71d7b3f708] has joined #fedora-meeting
16:32 < mmcgrath> 10
16:32 -!- mmcgrath changed the topic of #fedora-meeting to: Infrasturcture -- Meeting Closed!
16:32 < mmcgrath> thanks for coming everyone
16:32 < dgilmore> :) thanks
16:32 * mmcgrath gets back to the final bits of FAS2 and fixing fedorapeople.
16 years, 2 months
Password Migration
by Frank Chiulli
Should the password migration associated with FAS2 be complete by now?
I still have to use my old password on publictest1.
Frank
16 years, 2 months
FAS2 ships!
by Mike McGrath
FAS2 has shipped. Its getting a bit late in the evening so I'm not going
ot enable the cron job qute yet so don't be surprised if your account
information for shell access is stale until tomorrow morning.
Most of our end users should be unaffected though.
-Mike
16 years, 2 months
ssh problem. Its me or the server ?
by susmit shannigrahi
Hi,
I am trying to ssh into bastion.fedoraproject.org using my new public
key. (id_dsa.pub)
For this
> I have created a new set of key.
> Uploaded the public one by editing my fedora account.
But whenever I am trying to connect the server returns permission denied.
I have verified that my ip is not in deny list.
Is there anything I missed? Or its some problem due to migration? (Unlikely)
Is there any sync delay?
The output is attached herewith.
--
Regards,
Susmit.
=============================================
ssh
0x86DD170A
http://www.fedoraproject.org/wiki/SusmitShannigrahi
=============================================
16 years, 2 months
Rename cvsextras during FAS2 switch?
by Warren Togami
Hi folks,
I am wondering, might it be a good time to s/cvsextras/packager/ during
the move to FAS2? It might be an opportune time because everything will
be down anyway?
I am just afraid if we don't do it now we might still have it a year
from now. =)
Just a thought.
Warren
16 years, 2 months
Host DOWN alert for gateway! (fwd)
by Mike McGrath
Was anyone on these boxes when this happened or by chance caused it? The
outage was very short probably less than a minute, I'm digging through
lots and such but I thought I'd ask. I think it was a network issue or
possibly OpenVPN as bastion never actually was down.
-Mike
---------- Forwarded message ----------
Date: Sun, 9 Mar 2008 21:30:02 GMT
From: Nagios Monitoring User <nagios(a)fedoraproject.org>
To: mmcgrath(a)redhat.com
Subject: Host DOWN alert for gateway!
***** Nagios *****
Notification Type: PROBLEM
Host: gateway
State: DOWN
Address: gateway.vpn.fedoraproject.org
Info: PING CRITICAL - Packet loss = 100%
Date/Time: Sun Mar 9 21:30:02 UTC 2008
16 years, 2 months
But 429469
by Mike McGrath
In our efforts to track down https://bugzilla.redhat.com/429459 I've
disabled all iscsi on xen2. Some of those guests have been moved
elsewhere, and some of them have been converted to local storage.
Please do not enable iscsi on xen2 without coordinating it and making sure
we're not in the middle of something on that ticket.
-Mike
16 years, 2 months
proxy2
by Mike McGrath
Forgot to mention proxy2 has been re-installed. If you try to ssh to it
and you get a key notification, thats why.
-Mike
16 years, 2 months
Announcing FAS2 Tests!
by Mike McGrath
Well, we've been working on it for a long time and even with a last minute
core technology change FAS2 is ready for testing and almost ready for
deployment. What is FAS2 you ask? Its the second iteration of the Fedora
Accounts System. It's based off of TurboGears and has so many standards
and future expandability I won't even go into that here. What I will say
is that we'd like everyone to come test it before we deploy it in the next
week or two.
The test site is at: https://publictest10.fedoraproject.org/accounts/
This system is completely separate from the current running system so feel
free to come in, setup a test account, or 2 or 10, and groups. If you'd
like admin or sponsor access to a group just stop by #fedora-admin and ask
for it and someone will set you up. What are features to look forward to
in FAS2?
* Online help system
* Translations (the systems there but without translations currently)
* JSON Interface
* More comprehensive client for shell access
* Easier to sign the CLA
* OpenID interface (work in progress)
* Much less developer-centeric interface
To get your own local install going just run:
yum install git-core
git clone git://git.fedorahosted.org/git/fedora-infrastructure.git/
cd fedora-infrastructure.git/fas
vi README
If you have any bugs to report please send them to:
https://fedorahosted.org/fas2/
We're also taking feature requests though they will likely not make it
into the initial deployment. Happy hacking!
16 years, 2 months
