4:01 p.m.
[15:01] mmcgrath has set the subject to Fedora Infrastructure -- Who's here
[15:01] mmcgrath: ping all, who's here?
[15:01] * skvidal is here
[15:02] * xDamox is here
[15:02] * Bob-Laptop is not here but does not really count yet
[15:02] mmcgrath: paulobanon, dgilmore, mbonnet__, mbonnet, abadger1999, f13: ping
[15:02] * paulobanon is here
[15:03] notting has joined the group chat (n=notting@redhat/notting)
[15:03] * abadger1999 is here
[15:03] mmcgrath: allright
[15:04] mmcgrath has set the subject to Fedora Infrastructure -- Ticketing System
[15:04] mmcgrath: Lets talk about this and try to come to a conclusion today.
[15:04] * mmcgrath notes the schedule -
http://fedoraproject.org/wiki/Infrastructure/Schedule
[15:04] mmcgrath: So here's my current concern.
[15:04] mmcgrath: I'm getting a lot of emails for requests for stuff that anyone in
the team could do.
[15:05] mmcgrath: So as we discussed on the list the options are moving to a mailing list
or trac.
[15:05] mmcgrath: What do you guys think? (you don't have to be in the Infrastructure
team to have a comment on this)
[15:05] paulobanon: trac for me
[15:06] skvidal: I can adapt to either - I think a list is easy - but if there's an
rss feed for trac I'll accept that
[15:06] mmcgrath: skvidal: good question.
[15:06] mmcgrath: f13: does track have an rss feeder?
[15:07] * mmcgrath thinks f13 is away.
[15:07] skvidal: Indeed
[15:07] abadger1999: trac has an rss feed for timeline. Not sure if tickets show up in
timeline or not.
[15:07] paulobanon: http://trac.edgewall.org/wiki/TracRss
[15:07] mmcgrath: abadger1999: are you a trac fan or a mail list fan?
[15:08] paulobanon: yes it support tickets
[15:08] abadger1999: We need to have both a ml and ticketing system.
[15:09] mmcgrath: k, so I'll work on getting a trac system setup and properly
configured with Infrastructure for us to take a look at. We can decide to keep it and
announce it hopefully next week.
[15:09] paulobanon: sounds good
[15:10] mmcgrath: ok, moving on.
[15:10] mmcgrath has set the subject to Fedora Infrastructure -- Package Database
[15:10] mmcgrath: abadger1999: how are you and G doing?
[15:11] G: I've been a little bit on hold, I've got next week off, so I hope to
dedicate a bit of time to it
[15:11] mmcgrath: G: cool.
[15:11] mmcgrath: G: where are you two currently running tests from?
[15:12] G: Toshio created a hosted instance though
(http://hosted.fedoraproject.org/projects/packagedb
[15:12] G: err. test3 I think
[15:12] mmcgrath: test3, k.
[15:12] mmcgrath: k, moving on.
[15:13] mmcgrath: Nothing new in configuration managemnt.
[15:13] mmcgrath has set the subject to Fedora Infrastructure -- VCS choice
[15:13] mmcgrath: jcollie: ping
[15:13] jcollie: mmcgrath, wassup?
[15:13] jcollie: oops
[15:14] mmcgrath: I'm going to have some publictest1 space for you soon for
http://fedoraproject.org/wiki/Infrastructure/RFR/GitPackageVCS
[15:14] jcollie: on a phone call, but no progress since last week
[15:14] jcollie: mmcgrath, thanks!
[15:14] mmcgrath: jcollie: k, can you apply for the sysadmin-test group when you get a
mment?
[15:14] jcollie: sure
[15:14] * mmcgrath will continue
[15:15] mmcgrath has set the subject to Fedora Infrastructure -- Firewall system rewrite
[15:15] mmcgrath: xDamox: how's all that going?
[15:15] mmcgrath: and the new custom rules?
[15:15] xDamox: mmcgrath, just got to get skvidal to check over this torrent policy
[15:15] skvidal: xDamox: I did check it over
[15:15] skvidal: is there a new one?
[15:15] xDamox: the one in my home dir?
[15:16] xDamox: on lockbox
[15:16] abadger1991 has joined the group chat
(n=abadger1(a)068.187-78-65.ftth.swbr.surewest.net)
[15:16] riel has joined the group chat (n=riel(a)bree.surriel.com)
[15:16] skvidal: did you tell me about those before today?
[15:16] skvidal: I looked at what we talked about before
[15:16] xDamox: nope
[15:16] skvidal: oh, okay
[15:16] xDamox: I was going to email you tonight
[15:17] MrBawb has joined the group chat (i=abob(a)guppy.drown.org)
[15:17] skvidal: yes, continue with that plan
[15:17] skvidal:
[15:17] skvidal: thank you
[15:17] mmcgrath:
[15:17] xDamox: if your happy I can check them in to puppet and firewall will be done
[15:17] * dgilmore is here
[15:17] * abadger1991 back
[15:18] mmcgrath: xDamox: excellent.
[15:18] skvidal: cool-mo-dee
[15:18] xDamox:
[15:18] mmcgrath: xDamox: anything else?
[15:18] xDamox: do you want any firewall rules applied to xen?
[15:19] JSchmitt has joined the group chat (n=s4504kr(a)p54B1127B.dip0.t-ipconnect.de)
[15:19] xDamox: XEN are the only hosts without firewall rules
[15:19] dgilmore: xDamox: yes but we need to work out what
[15:19] xDamox: yea not a problem
[15:19] mmcgrath: ahhh yes.
[15:19] mmcgrath: So here's the problems to overcome.
[15:19] mmcgrath: We'd like to be able to block traffic from the xen guests at the xen
host.
[15:19] dgilmore: xDamox: we have some guests we want almost no access to others inside
the colo
[15:20] mmcgrath: Note, the xen guests will move around so its probably smart to have the
same rules on all xen hosts.
[15:20] dgilmore: probbaly need to use ebtables on the xen bridge
[15:20] xDamox: Ok
[15:20] mmcgrath: and 2) the interface name might change when migrating around so rules
based off of interface won't work.
[15:20] mmcgrath: ip rules off of IP are easy to circumvent
[15:20] mmcgrath: ip rules off of mac may be spoofable (but could be our best bet)
[15:21] mmcgrath: Any suggestions there?
[15:21] xDamox: I would go with MAC addresses
[15:21] dgilmore: mac address absed rules on the bridges
[15:21] xDamox: that would be the best bet
[15:22] mmcgrath: dgilmore: ahh, very true.
[15:22] fchiulli has left ("CGI:IRC (Ping timeout)"
(i=824c400f(a)gateway/web/cgi-irc/ircatwork.com/x-63cc1cf3a5d2721f))
[15:22] warren: The guests cannot change their MAC
[15:22] warren: ?
[15:22] mmcgrath: ok, so we can work on those when the time comes.
[15:22] mmcgrath: warren: the guest can probably change it but the host won't honor
it.
[15:22] warren: ah
[15:22] mmcgrath: at least in theory, we'll have to test that.
[15:22] warren: sounds like a plan
[15:23] warren: You might not need to use ebtables though
[15:23] warren: I've used iptables MAC module before
[15:23] fchiulli has joined the group chat
(i=824c400f(a)gateway/web/cgi-irc/ircatwork.com/x-1f7399ce8f2ba354)
[15:23] dgilmore: warren: ona bridge?
SmootherFrOgZ_id is now known as SmootherFrOgZ
[15:23] warren: dgilmore, oh, good question.
[15:23] warren: It is worth trying though
[15:24] warren: If it works, that's one less additional thing to track
[15:24] mmcgrath: <now> we should take this to the list.
[15:24] warren: agreed
[15:24] dgilmore: mmcgrath: quite possibly we could do rules for known macs we want to
allow access then deny everything else
[15:25] abadger1999 has left (No route to host
(n=abadger1(a)068.187-78-65.ftth.swbr.surewest.net))
[15:25] mmcgrath: dgilmore: thats true, its good to know we have options. We'll just
have to find the solution thats best for our environment.
[15:25] dgilmore: so if they change mac and its honored we still drop
[15:25] mmcgrath: <nod>
[15:25] mmcgrath: I skipped one item
[15:25] paulobanon: +1
[15:25] mmcgrath has set the subject to Fedora Infrastructure -- DB1 upgrade
[15:25] mmcgrath: mbonnet__: ping?
[15:25] mmcgrath: mbonnet: ?
[15:25] lennert: iptables can filter on --mac-source on input/forward, anything more fancy
needs ebtables
abadger1991 is now known as abadger1999
[15:25] mmcgrath: Right now we're just waiting on the ok from mbonnet to make sure the
new postfix version will support koji.
[15:26] mbonnet__: mmcgrath: sorry, in a meeting
[15:26] mmcgrath: mbonnet__: no worries, I'll just move to the next item.
[15:26] mmcgrath: but thats where db1 is at right now.
[15:26] mmcgrath has set the subject to Fedora Infrastructure -- Server Upgrades
[15:26] abadger1999: s/postfix/postgres/
[15:26] warren: mmcgrath, what about postfix doesn't support koji?
[15:26] mmcgrath: abadger1999: err yes
[15:26] warren: oh
[15:26] warren: =)
[15:26] * mmcgrath has post on the mind
[15:27] mmcgrath: So I'm working with the soc on some items with the server upgrade.
[15:27] dgilmore: mmcgrath: for what its worth my koji install has a FC-6 based postgres
[15:27] paulobanon: i think everyone got confused with that one
[15:27] mmcgrath: dgilmore: excellent.
[15:27] mmcgrath: The new disk tray for our builders came in and is now in use.
[15:27] dgilmore: running on sparc but its FC-6
[15:27] dgilmore:
[15:27] mmcgrath: 2.0T 691G 1.3T 35% /mnt/ntap-fedora1/fedora
[15:27] dgilmore: f13: dont fill it
[15:27] warren: sparc?
[15:28] dgilmore: warren: yes sparc
[15:28] mmcgrath: I think there's some koji work to enable better garbage collection.
Keep in mind whats in our 691G of space right now.
[15:28] mmcgrath: Just Fedora 7.
[15:28] mmcgrath: well and some other stuff.
[15:29] dgilmore: mmcgrath: rawhide also
[15:29] mmcgrath: Also I'm working with the soc to get some warranty stuff figured
out. There's some server's I need to double check.
[15:29] mmcgrath: <nod> rawhide.
[15:29] mmcgrath: which right now is basically F7
[15:29] mmcgrath has set the subject to Fedora Infrastruture -- Xen Conversions
[15:29] mmcgrath: I've converted a few more boxes to the iscsi share. We're up
to...
[15:30] mmcgrath: 12 hosts at present.
[15:30] mmcgrath: many of them test, a few of them are production.
[15:30] paulobanon: how many left _
[15:30] paulobanon: ?
[15:31] mmcgrath: paulobanon: depends, I don't have a final count right now but by the
time we get the server upgrades the target number will change drastically.
[15:31] paulobanon: k k
[15:31] mmcgrath: thats all the priority 1 stuff
[15:31] mmcgrath: Nothing new on bacula
[15:31] mmcgrath: translators stuff is still going well
[15:31] mmcgrath: nothing new on accoutns
[15:32] skvidal: did everyone look to make sure they had all their stuff off of fpserv?
[15:32] mmcgrath: f13 isn't around but I suspect nothing terribly new on hosted.
[15:32] skvidal: I emailed about it but didn't get any response
[15:32] mmcgrath has set the subject to Fedora Infrastruture -- FedoraPeople.org
[15:32] mmcgrath: skvidal: everything I have on there should be vanishable
[15:33] skvidal: okie doke
[15:33] skvidal: I'll take that as definitive
[15:33] mmcgrath: heh
[15:33] paulobanon: kill fpserv!
[15:33] paulobanon:
[15:33] mmcgrath has set the subject to Fedora Infrastructure -- Ibiblio Mirror
[15:33] skvidal: thank you
[15:33] mmcgrath: I've been laxed on this, I just need to test that they have
everything exported correctly.
[15:34] mmcgrath: then find some testers.
[15:34] mmcgrath: So thats all the stuff on the schedule.
[15:34] mmcgrath has set the subject to Fedora Infrastructure -- Open Floor
[15:34] mmcgrath: Anyone have anything they'd like to discuss?
[15:34] dgilmore: skvidal: i had nothing on fpserv
[15:34] skvidal: dgilmore: cool
[15:34] mmcgrath: notting: ping
[15:34] skvidal: dgilmore: I just wanted to be sure
[15:35] notting: mmcgrath: yes?
[15:36] paulobanon: whats with all priority 3 stuff ? is it something that we even want to
have there and move it to a thinking about it section ?!
[15:36] paulobanon: s/and/or
[15:36] mmcgrath: notting: do you have a moment to discuss the signing server?
[15:37] mmcgrath: paulobanon: I don't know what is with that stuff.
[15:37] mmcgrath: paulobanon: that reminds me though can you add the wiki cla stuff
you're doing with quaid to the list in priority 2?
[15:37] paulobanon: yup
[15:37] notting: mmcgrath: sure
[15:38] mmcgrath: notting: just give us a quick overview of what you guys are doing, what
you'll need and what problem it solves.
[15:39] notting: ok
[15:39] notting: first of all, lots of info at
http://fedoraproject.org/wiki/JesseKeating/SigningServerSpecDraft
[15:39] mmcgrath: ohhh, very nice.
[15:40] notting: the idea is that instead of just handing out gpg keys and passphrases, we
use a signing server to sign packages
[15:40] * warren yay!
[15:40] notting: this server will have lists of what people (FAS accounts) are allowed to
sign with what keys
[15:40] notting: there is some code that RH has
[15:40] notting: however, to use a) FAS b) koji it's going to take a lot of hacking.
might just need redone
[15:41] notting: what we need: a locked down box with very limited access
[15:41] notting: as the box will need to have private keys on it
[15:41] warren: So outside of the normal FI authentication
[15:42] warren: sysadmin-main shouldn't be able to login as root
[15:42] rdieter has joined the group chat (n=rdieter(a)ip68-110-20-4.om.om.cox.net)
[15:42] paulobanon: notting: its the RFR/FedoraCertificateSystem right ?!
[15:42] mmcgrath: warren: Doesn't have to be. We don't have to include
sysadmin-main
[15:42] notting: probably not
jwb is now known as jwb_gone
[15:42] mmcgrath: warren: oh, nm, I think we're talking about the same thing
[15:42] dgilmore: warren: no one should log in as root on any box unless its to fix
something broken
[15:42] warren: dgilmore, true
couf is now known as couf_afk
[15:43] warren: mmcgrath, I mean... regular sysadmins or people who could mess with the
account system shouldn't be able to grant access to the signing server.
[15:43] mmcgrath: notting: we can work on that part. I've also considered looking
into something like two factor authentication for the signers.
[15:43] notting: yeah, it's sort of up in the air how much auth we want from the
signers w.r.t FAS (ssh key + fas user/pw? more?)
[15:43] mmcgrath: notting: will the private keys been encrypted?
[15:44] paulobanon: SELinux it hard
[15:44] notting: mmcgrath: as much as any gpg private keys are
[15:44] mmcgrath: k, so we'll just have to discuss and find what solution works best
for us.
[15:44] notting: the box does *not* need to be public facing, but it will need to be
accessible from the colo so people can request sigs
[15:44] mmcgrath: notting: do you guys have a time frame on any of this yet?
[15:44] notting: wait, strike that
[15:44] warren: signing server shouldn't be connected or depend on FAS at all
[15:45] JSchmitt_ has joined the group chat (n=s4504kr(a)p54B11AD8.dip0.t-ipconnect.de)
[15:45] notting: if we want people to sign who don't have some sort of bastion access,
i suppose it does need to be public
[15:45] mmcgrath: notting: going through bastion won't be an issue.
[15:45] fab has left (Read error: 104 (Connection reset by peer) (n=bellet(a)bellet.info))
[15:45] fab_ has left (Read error: 104 (Connection reset by peer) (n=bellet(a)bellet.info))
[15:45] notting: mmcgrath: considering we don't have server code yet, no.
[15:45] tibbs has left ("Konversation terminated!" (i=tibbs@fedora/tibbs))
[15:45] warren: notting, we could abstract access through koji or something.
[15:45] warren: notting, koji keeps track of what wants signing
[15:46] notting: warren: koji has click-through cert auth. makes it *TRIVIAL* to
impersonate someone with merely phyiscal access to their box
[15:46] warren: notting, oh, I meant requesting signs, not actual signing.
[15:46] mmcgrath: notting: we'll keep it on our radar for now. let us know when it
becomes more... imminent
[15:46] warren: notting, isn't it safe to assume that someone trusted to do actual
signing should have bastion access?
[15:47] mmcgrath: notting: we could look at physical key requirements as well. How many
signers do you suspect we'll have?
[15:47] notting: warren: in that they're trusted enough to have bastion access, yes,
however, it's entirely possible that they wouldn't have needed it for anything
else
[15:48] notting: mmcgrath: dunno. more than 2, less than 10.
[15:48] mmcgrath: <nod>
[15:48] mmcgrath: notting: thanks, we'll keep our eyes out for it.
[15:48] mmcgrath: In the meantime does anyone have anything else they'd like to
discuss?
[15:48] mmcgrath: paulobanon: you had something?
[15:48] mmcgrath: oh the priority 3 stuff
[15:48] warren: ssh with pubkey -> somehost, where they don't see a shell, it asks
for a passphrase that is private for each signer.
[15:49] paulobanon: cant we take a quick tour on that and on the not implemented RFRs
[15:49] paulobanon: and see what can or not be done
[15:49] mmcgrath: sure, so a lot of those things are just sort of on hold.
[15:49] mmcgrath: the priority 3 stuff.
[15:49] paulobanon: cause for someone not on the list for long, it looks like we do
nothing
[15:49] paulobanon: since that never changes
[15:49] mmcgrath: I can confirm that postfix, finoc, mailman and speeding up the wiki are
on hold or blocking on other people.
[15:50] mmcgrath: lmacken: ping?
[15:50] fab has joined the group chat (n=bellet(a)bellet.info)
[15:50] mmcgrath: rhlinux.redhat.com migration is the same thing as the elvis stuff.
thats going on.
[15:50] paulobanon: FedoraPasteBin - everyone uses pastebin, we still interested in having
our one ?
[15:50] mmcgrath: the look and feel stuff ricky is working on (though not aorund)
[15:50] mmcgrath: yeah, I think it would be good to have our own. Just have to install it
I suppose.
[15:51] mmcgrath: and these are the RFR's -
http://fedoraproject.org/wiki/Infrastructure/Schedule?action=fullsearch&a...
[15:51] paulobanon: no need for that big url
[15:51] paulobanon: just go for /RFR/
[15:51] paulobanon: you have all if you scroll down
[15:51] paulobanon: i added all of them there
[15:52] paulobanon: until 2 weeks ago i think
[15:52] mmcgrath: paulobanon: but some are missing.
[15:52] mmcgrath:
[15:52] paulobanon: ill update it later then
[15:52] paulobanon: requesters should add the link there
[15:52] mmcgrath: so those are the rfr's. Some are taken, some aren't. Most are
just waiting for worker bees.
[15:52] paulobanon: lazy guys
[15:53] mmcgrath: paulobanon: I actually skipped doing the list that way just because its
so easy to do a search for "Infrastructure/RFR"
[15:53] paulobanon: where do u want the pastebin ? i can talk with lmacken to have it
deployed
[15:53] mmcgrath: paulobanon: go ahead and contact luke. see what he says.
[15:53] dgilmore: paulobanon: we were going to integrate it waith fas
[15:53] paulobanon: will do
[15:53] warren: dgilmore, cool, limit spam.
[15:54] mmcgrath: dgilmore: we can let apache do that if we want, should be pretty easy.
[15:54] dgilmore: paulobanon: i think thats the main reason it stalled
[15:54] dgilmore: mmcgrath: yeah i think skvidal has some turbogears app he wanted to
use
[15:54] * mmcgrath seems to remember some of that.
[15:54] skvidal: dgilmore: a loooooooong time ago
[15:54] warren: dgilmore, I saw other pastebins without auth used by random people as a
way to store links to warez
[15:54] dgilmore: mmcgrath: abadger1999's fedora-python stuff should help
[15:55] dgilmore: warren: sure
[15:55] mmcgrath: yep, the fedora-python stuff is beautiful. And very easy to use.
[15:55] paulobanon: cant we limit access the same way we limit access to teh cgi's in
the admin site ?
[15:55] mmcgrath: Ok, we've got a couple of minutes left. Anyone else have anything
they'd like to discuss?
[15:55] dgilmore: skvidal: so now your a RHer you can get er done
[15:55] skvidal: dgilmore: heh, I'll put it on my list
[15:56] * dgilmore has nothing
[15:56] skvidal: just not ultra-highpriority, ok?
[15:56] dgilmore: skvidal: sure
[15:56] abadger1999: mmcgrath: People have been getting interested in FAS2 recently. But
the instance on the test servers is down and we need to have a list of FAS tasks they can
jump in to work on.
[15:56] mmcgrath: abadger1999: I haven't had anyone contact me with help. The fas
link should be back up in a bit actually.
[15:57] abadger1999: Cool.
[15:57] paulobanon: should we create a Tasks list like the other SIGs have ?!
[15:57] paulobanon: instead of having everything in the schedule
[15:58] paulobanon: if we are gonna test trac, we could convert the current schedule in
tasks, and get a proper schedule with milestones in Trac
[15:58] mmcgrath: paulobanon: We'll have to see more when we get into Trac.
[15:58] mmcgrath: The thing about schedules is that its always been around and we've
always used it, when OTRS came around we just ignored it.
[15:59] mmcgrath: I guess we'll just have to set it up and see if we can get our team
to actually use it.
[15:59] paulobanon: true
[15:59] mmcgrath: Ok, we're about to run over time.
[15:59] mmcgrath: If no one has anything pressing I'll close the meeting in 30
[15:59] mmcgrath: 10
[15:59] mmcgrath:
[15:59] fchiulli has left (
(i=824c400f(a)gateway/web/cgi-irc/ircatwork.com/x-1f7399ce8f2ba354))
[16:00] mmcgrath has set the subject to Meeting closed
[16:00] mmcgrath: thanks for coming guys.