infrastructure March 2008

infrastructure@lists.fedoraproject.org

44 participants
48 discussions

Meeting Log - 2008-03-13
by Ricky Zhou 14 Mar '08

14 Mar '08

16:01 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Meeting, who's here? 16:02 < ivazquez> Pong. 16:02 * nirik lurks in the background 16:02 -!- jmtaylor [n=jason(a)c-76-112-119-170.hsd1.mi.comcast.net] has joined #fedora-meeting 16:02 < mmcgrath> jmtaylor: yo, just getting started 16:03 < mmcgrath> skvidal: dgilmore: ping 16:03 -!- kambiz [n=kambiz(a)vorlon.oit.duke.edu] has joined #fedora-meeting 16:03 < skvidal> yah 16:03 < skvidal> in and out 16:03 * mmcgrath thinks RDU and Boston are having problems and pycon is going on right now so its quite possible lots of people won't be here today 16:03 * whitenoise 's around :P 16:03 < jmtaylor> mmcgrath: cool 16:04 < mmcgrath> alrighty, well we'll get started just the same 16:04 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- tickets 16:04 < mmcgrath> .tiny https://fedorahosted.org/fedora-infrastructure/query?status=new&status=assi… 16:04 < zodbot> mmcgrath: http://tinyurl.com/2hyyz6 16:05 < mmcgrath> .ticket 421 16:05 < zodbot> mmcgrath: #421 (Fedora Mirror Space) - Fedora Infrastructure - Trac - https://fedorahosted.org/projects/fedora-infrastructure/ticket/421 16:05 * dgilmore is here 16:05 < mmcgrath> AFAIK f13's handling the actual pushing of those bits around 16:05 < mmcgrath> f13: you here? 16:05 * mmcgrath guesses not 16:05 < jwb> he's missing at the moment 16:06 -!- ezq [n=ezq(a)host83.190-224-57.telecom.net.ar] has quit "leaving" 16:06 < mmcgrath> either way I think thats mostly taken care of, I'll remove the meeting tag from it. 16:06 -!- J5 [n=quintice@nat/redhat/x-16fc084f9202d358] has joined #fedora-meeting 16:06 -!- J5 [n=quintice@nat/redhat/x-16fc084f9202d358] has quit Client Quit 16:06 * ricky is here for ~5 minutes 16:06 < mmcgrath> ricky: yo 16:06 -!- J5 [n=quintice@nat/redhat/x-151d921351e45e15] has joined #fedora-meeting 16:06 < mmcgrath> jcollie isn't here so we'll skip ticket 395 16:06 < mmcgrath> .ticket 398 16:06 < zodbot> mmcgrath: #398 (elfutils `monotone' (mtn) error) - Fedora Infrastructure - Trac - https://fedorahosted.org/projects/fedora-infrastructure/ticket/398 16:07 < mmcgrath> not much new here, I submitted a bug upstream and they claim there's lots of ways to do what we suggest, none of which are very good. 16:07 < mmcgrath> so I'm keeping an eye on that but I haven't actually looked to implement anything and I don't think anyone else has either 16:07 < mmcgrath> so moving on 16:07 < mmcgrath> .ticket 446 16:07 < zodbot> mmcgrath: #446 (Possibility to add external links on spins page) - Fedora Infrastructure - Trac - https://fedorahosted.org/projects/fedora-infrastructure/ticket/446 16:07 < mmcgrath> this is a new one from today. 16:08 -!- abadger1999 [i=3ffaf10a(a)gateway/web/ajax/mibbit.com/x-cec616d81473dc45] has joined #fedora-meeting 16:08 < mmcgrath> I've got to be honest, I'm not to keen on this idea of linking to other places for stuff. It feels hackish and silly. 16:08 < mmcgrath> having said that, the spins policies aren't set in stone yet so the fr people don't have many options. 16:08 < mmcgrath> So reluctantly we may have to allow this through. 16:08 * glezos is around if needed 16:08 < mmcgrath> glezos: howdy 16:09 < mmcgrath> does anyone have any comments or questions about htat? 16:09 < mmcgrath> it will take some code changes on our spins page. 16:09 < ivazquez> What happens if the policy comes down that external links are not allowed, after we've placed it? 16:09 < mmcgrath> then we'll remove it. 16:09 < mmcgrath> I'll send a feeler to the FAB now as it will likely take us a little bit to get the scripts in order anyway 16:10 < mmcgrath> well, I would if I could get to my mailbox. 16:10 * mmcgrath makes post-it note 16:10 < ivazquez> Has this been posed to the people handling the spins policies? 16:10 < mmcgrath> ivazquez: nope, they've been discussing it on the fab though. 16:11 < mmcgrath> so they'll comment when I send the feeler. 16:12 < mmcgrath> skvidal: any word on the new spins box? I know you've been busy this week with yum stuff. 16:12 < dgilmore> id rather not link outside 16:12 < ivazquez> Likewise. 16:12 < skvidal> mmcgrath: I'm waiting to make sure it stays up :) 16:12 < skvidal> it's been 7 days 16:13 < skvidal> I just want to make sure it's not keeling over like it was before 16:13 < skvidal> then we can move forward w/it 16:13 < mmcgrath> solid 16:13 < mmcgrath> Ok, moving on from tickets 16:13 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- FAS2 16:14 < dgilmore> woohoo 16:14 < mmcgrath> So fas2 shipped, its been doing fine. we had an issue yesterday but couldn't trace it to fas specifically, just strangeness in the db connections filling up mostly with koji requests and the old account system. 16:14 < mmcgrath> could have been a migration bug 16:14 < ricky> Aww, I'm going to miss part of this :( 16:14 -!- abadger1991 [n=abadger1(a)63.250.241.10] has joined #fedora-meeting 16:15 < dgilmore> fas2 seems to have been recieved really well 16:15 < mmcgrath> ricky: no worriesl 16:15 < mmcgrath> all in all things went well, there's still a few outstanding issues, fedorapeople being one of them right now. 16:16 < dgilmore> mmcgrath: whats up with fedorapeople? 16:17 < mmcgrath> dgilmore: well the nssdb is messed up so no one hsa accounts on it. 16:17 < dgilmore> :( thats not fun 16:17 < dgilmore> so we have someone with local access fixing? 16:17 < mmcgrath> its a pretty easy thing to fix but a security 'feature' in fas is preventing me from doing it :) 16:17 < mmcgrath> dgilmore: I can still get i nand with a shell, its just this pesky meeting got in the way of me fixing it :) 16:18 -!- till__ [n=till(a)genius.kawo2.RWTH-Aachen.DE] has joined #fedora-meeting 16:18 < dgilmore> mmcgrath: i see so its not a big deal then 16:18 < mmcgrath> not a big deal. 16:18 < mmcgrath> just lots of little things here and there. 16:18 < dgilmore> one question i have with fas2 is setting up sandboxes 16:18 < mmcgrath> big thanks goes out to ricky and toshio. 16:18 < mmcgrath> dgilmore: shoot 16:19 < dgilmore> say i put up a sparc box like fedorapeople.org where contributors get ssh and mock access 16:19 < dgilmore> id rather tie it into fas 16:19 < skvidal> dgilmore: mock? you sure? 16:19 < stickster> mmcgrath: I hope to have final word to you soon on CLA stuff 16:19 < dgilmore> im sure dwmw2_gone would want to do the same for his ppc64 box 16:19 -!- tyll [n=till(a)genius.kawo2.RWTH-Aachen.DE] has quit Nick collision from services. 16:20 < mmcgrath> stickster: excellent. 16:20 < stickster> mmcgrath: The relevant legal eagle just got back to the office today after being gone a bit. 16:20 < dgilmore> skvidal: to all people to test builds on sparc 16:20 < mmcgrath> dgilmore: yeah, I've thought about this, jesse has a similar box in question. 16:20 < dgilmore> to allow 16:20 < mmcgrath> dgilmore: so here's the thing. In general I'd like to allow third parties to be able to access fas. I'm going to write up some guidelines first for us all to go over. 16:20 < mmcgrath> The main concerns being... 16:20 < mmcgrath> 1) password harvesting 16:20 < dgilmore> skvidal: not mock on fedorapeople but same set of accounts 16:20 < mmcgrath> 2) password harvesting :) 16:21 < mmcgrath> and the problem with mock is it allows you to get root on the box. 16:21 < dgilmore> mmcgrath: id be happy disabling password auth and only allowing ssh 16:21 -!- till__ is now known as tyll 16:21 < dgilmore> mmcgrath: i.e put in something fake for a passwd 16:21 < mmcgrath> dgilmore: but if someone ssh'd and forwarded their key there's still issues there. 16:22 < dgilmore> mmcgrath: true 16:22 < mmcgrath> so the anwser is yes, I'd like to do something like that. 16:23 < mmcgrath> but I'm not sure the right way to go about it at this time. 16:23 < mmcgrath> I suspect a good answer will be for users to somehow get temporary passwords setup and emaild to them from that box. 16:23 < mmcgrath> and disallowing key based auth. 16:23 < mmcgrath> we can talk more about that later. 16:24 < mmcgrath> and there's lesser levels of integration I'd like to be able to just offer without much effort to people, like the fedora unity folks, who may want to get group information. 16:24 < dgilmore> that could be a possibily 16:24 < mmcgrath> anyone have any other questions? 16:24 -!- sereinity [n=sereinit(a)mon69-3-82-235-39-70.fbx.proxad.net] has joined #fedora-meeting 16:24 < mmcgrath> alllrighty 16:25 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Me won't be here for much longer this month. 16:25 < mmcgrath> This is a notice to everyone. 16:25 < mmcgrath> I'm goin gto be gone, pretty much the rest of the month 16:25 < jeremy_> mmcgrath: that's not allowed! 16:25 < mmcgrath> either at pycon, training or in vegas towards the end of the month 16:25 < mmcgrath> jeremy_: but but but vegas!!!! 16:25 < jeremy_> mmcgrath: work! 16:25 < jeremy_> back to it! 16:25 -!- wwoods [n=wwoods@nat/redhat/x-4a06e36cb94bc1b3] has joined #fedora-meeting 16:25 -!- cra [n=cra(a)about/networking/255.255.255.4/cra] has joined #fedora-meeting 16:25 -!- gregdek [n=gdk@nat/redhat/x-e254f54b8dd98d7c] has joined #fedora-meeting 16:25 < mmcgrath> so I'll be peaking my head in, and checking my email. But during the day I'll largely be gone 16:26 -!- poelcat_ [n=poelcat@fedora/poelcat] has joined #fedora-meeting 16:26 * mmcgrath sees RDU is back online 16:26 < mmcgrath> so thats that really. 16:26 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Open Floor 16:26 < mmcgrath> who's got something else they'd like to discuss? 16:27 < dgilmore> how has xen2 been holding up 16:27 < mmcgrath> dgilmore: good question. 16:27 < mmcgrath> So xen2 16:27 * mmcgrath finds the bz number 16:27 < mmcgrath> .bug 429469 16:27 < buggbot> Bug https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=429469 low, low, rc, Mike Christie, NEW , Frequent reboots of servers after upgrading to RHEL5. 16:27 < zodbot> mmcgrath: Bug 429469: Frequent reboots of servers after upgrading to RHEL5. - https://bugzilla.redhat.com/429469 16:27 < mmcgrath> so this one bit us hard. 16:27 < mmcgrath> During the trouble shooting late last week I disabled all iscsi based guests. 16:28 < mmcgrath> either converting them to local disk or moving them somewhere else. 16:28 < mmcgrath> This seems to have stopped the box from rebooting. 16:28 < mmcgrath> *however* 16:28 < mmcgrath> xen1 rebooted on... monday I want to say. 16:28 < mmcgrath> and it took on 2 guests from xen2, noc1 and app4 I believe. 16:28 -!- poelcat_ [n=poelcat@fedora/poelcat] has quit Client Quit 16:28 < mmcgrath> so its possible one of those guests wsa causing problems. 16:28 < mmcgrath> its possible it was a fluke. 16:28 < mmcgrath> but we're keeping an eye on it just the same. 16:29 < mmcgrath> needless to say, xen2's been pretty solid all week. 16:29 -!- jeremy_ [n=katzj(a)MUCKLEY-THREE-NINETY-NINE.MIT.EDU] has quit "back to the other client" 16:29 < mmcgrath> so thats the latest on that 16:29 < mmcgrath> Anyone have anything else they'd like to discuss? 16:31 < gkrpan> <-- looking into the RFR process. Nothing to report on it yet. 16:31 < mmcgrath> gkrpan: solid 16:31 < mmcgrath> ok, well we'll close the meeting in 30 16:31 -!- abadger1999 [i=3ffaf10a(a)gateway/web/ajax/mibbit.com/x-cec616d81473dc45] has quit "http://www.mibbit.com ajax IRC Client" 16:31 -!- jlaska [n=jlaska@nat/redhat/x-2b60db71d7b3f708] has joined #fedora-meeting 16:32 < mmcgrath> 10 16:32 -!- mmcgrath changed the topic of #fedora-meeting to: Infrasturcture -- Meeting Closed! 16:32 < mmcgrath> thanks for coming everyone 16:32 < dgilmore> :) thanks 16:32 * mmcgrath gets back to the final bits of FAS2 and fixing fedorapeople.

1 0

Password Migration
by Frank Chiulli 14 Mar '08

14 Mar '08

Should the password migration associated with FAS2 be complete by now? I still have to use my old password on publictest1. Frank

2 1

FAS2 ships!
by Mike McGrath 12 Mar '08

12 Mar '08

FAS2 has shipped. Its getting a bit late in the evening so I'm not going ot enable the cron job qute yet so don't be surprised if your account information for shell access is stale until tomorrow morning. Most of our end users should be unaffected though. -Mike

1 1

ssh problem. Its me or the server ?
by susmit shannigrahi 12 Mar '08

12 Mar '08

Hi, I am trying to ssh into bastion.fedoraproject.org using my new public key. (id_dsa.pub) For this > I have created a new set of key. > Uploaded the public one by editing my fedora account. But whenever I am trying to connect the server returns permission denied. I have verified that my ip is not in deny list. Is there anything I missed? Or its some problem due to migration? (Unlikely) Is there any sync delay? The output is attached herewith. -- Regards, Susmit. ============================================= ssh 0x86DD170A http://www.fedoraproject.org/wiki/SusmitShannigrahi =============================================

2 1

another issue to fix with the FAS2 switch: Kojis ssl certificate
by Till Maas 12 Mar '08

12 Mar '08

Hiyas, now that everyone needs to change his password, can we now also deploy the new certifcate for koji? This will make it possible to verify whether or not one can trust the certificate for koji and the ticket[1] is now 7 months old, i.e. about a full Fedora release cycle. Therefore I guess there won't be a better time than now. Regards, Till [1] https://fedorahosted.org/fedora-infrastructure/ticket/88

4 10

Rename cvsextras during FAS2 switch?
by Warren Togami 11 Mar '08

11 Mar '08

Hi folks, I am wondering, might it be a good time to s/cvsextras/packager/ during the move to FAS2? It might be an opportune time because everything will be down anyway? I am just afraid if we don't do it now we might still have it a year from now. =) Just a thought. Warren

4 4

Host DOWN alert for gateway! (fwd)
by Mike McGrath 09 Mar '08

09 Mar '08

Was anyone on these boxes when this happened or by chance caused it? The outage was very short probably less than a minute, I'm digging through lots and such but I thought I'd ask. I think it was a network issue or possibly OpenVPN as bastion never actually was down. -Mike ---------- Forwarded message ---------- Date: Sun, 9 Mar 2008 21:30:02 GMT From: Nagios Monitoring User <nagios(a)fedoraproject.org> To: mmcgrath(a)redhat.com Subject: Host DOWN alert for gateway! ***** Nagios ***** Notification Type: PROBLEM Host: gateway State: DOWN Address: gateway.vpn.fedoraproject.org Info: PING CRITICAL - Packet loss = 100% Date/Time: Sun Mar 9 21:30:02 UTC 2008

1 0

But 429469
by Mike McGrath 08 Mar '08

08 Mar '08

In our efforts to track down https://bugzilla.redhat.com/429459 I've disabled all iscsi on xen2. Some of those guests have been moved elsewhere, and some of them have been converted to local storage. Please do not enable iscsi on xen2 without coordinating it and making sure we're not in the middle of something on that ticket. -Mike

3 3

proxy2
by Mike McGrath 08 Mar '08

08 Mar '08

Forgot to mention proxy2 has been re-installed. If you try to ssh to it and you get a key notification, thats why. -Mike

1 0

Announcing FAS2 Tests!
by Mike McGrath 08 Mar '08

08 Mar '08

Well, we've been working on it for a long time and even with a last minute core technology change FAS2 is ready for testing and almost ready for deployment. What is FAS2 you ask? Its the second iteration of the Fedora Accounts System. It's based off of TurboGears and has so many standards and future expandability I won't even go into that here. What I will say is that we'd like everyone to come test it before we deploy it in the next week or two. The test site is at: https://publictest10.fedoraproject.org/accounts/ This system is completely separate from the current running system so feel free to come in, setup a test account, or 2 or 10, and groups. If you'd like admin or sponsor access to a group just stop by #fedora-admin and ask for it and someone will set you up. What are features to look forward to in FAS2? * Online help system * Translations (the systems there but without translations currently) * JSON Interface * More comprehensive client for shell access * Easier to sign the CLA * OpenID interface (work in progress) * Much less developer-centeric interface To get your own local install going just run: yum install git-core git clone git://git.fedorahosted.org/git/fedora-infrastructure.git/ cd fedora-infrastructure.git/fas vi README If you have any bugs to report please send them to: https://fedorahosted.org/fas2/ We're also taking feature requests though they will likely not make it into the initial deployment. Happy hacking!

5 8

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure March 2008