Chris, Brendan, and Karen needs ssh access (avr) about avalon HOT 25 CLOSED

Will need to work with NUIT to allow access.

from avalon.

Thanks let us us know when you get an ETA @Toputnal

from avalon.

Everyone should have access to: avalonweb1s, avalonweb2p, libwowza1p, libwowza1s, and alps. I will verify access to andes, libsolr1s, libsolr1p, libfedora1p, libfedora(123)s, libdb1s, libdb1p. Note that, with the exception of avalonweb2p and libwowza1p the remaining prod servers for AVR are not "puppetized," and use a hybrid authentication technique that allows NUIT to login to service our production servers, but which is currently incompatible with any of our puppet-managed authentication mechanisms. Consequently, changes like this, which ought to be simple, are more complicated and time consuming.

from avalon.

Thanks jim. Team, can you review and close?

from avalon.

I just tried this out and wasn't able to ssh into any machine except for alps. I can reach the servers via the network, but kept getting a permission denied error

from avalon.

Thanks for trying, Chris. I'll check the logs and see what is going on.

from avalon.

I am wondering if putting into place the changes David made on alps might make some of these machines start accepting passwords the way they ought to. Investigating....

from avalon.

hey @Toputnal , talk to @mbklein about some of the puppet issues too. I think you guys might be able to bring the avalon servers more in line with the rest of our environment now

from avalon.

A little update, here. This is linked nulib/devops 8.

from avalon.

Team, can you verify this and close... I made this handy checklist.

• @bmquinn
• @kdid
• @csyversen

from avalon.

@davidschober

NO for me on these as ksd927:

• avalonweb1s
• avalonweb2p
• libwowza1p
• libsolr1s
• libsolr1p
• libfedora1s
• libfedora2s
• libdb1s
• libdb1p

OK for me on these as ksd927:
libwowza1s
alps
andes
libfedora1p
libfedora3s

*Also wasn't sure there were other users I need access to on these specific servers? For example like 'deploy' or similar.

from avalon.

@Toputnal Did you see ^^^^^ from @kdid ?

from avalon.

NO for me on these as cas408:

• avalonweb1s
• avalonweb2p (is this a server?)
• libwowza1p
• andes

OK for me on these as cas408:
libwowza1s
alps
libfedora1p
libfedora3s
libsolr1s
libsolr1p
libfedora1s
libfedora2s
libdb1s
libdb1p

from avalon.

(also i checked off brendan because he's going to be out for a while, but he needs the same access as us)

from avalon.

I'm working on these both one at a time and all-at-once as I try to identify any pattern as to why some devs don't have access, even when all the puppet-controlled auth stuff says it's working.

from avalon.

@kdid and @csyversen can you please retest? I've cleared the check boxes so that you can check off every server into which you were previously unable to login. Please leave unchecked any that still don't work. Also note, ideally, we should be logging in using ssh keys instead of passwords, so please try logging in from a system that has your private ssh keys available.

from avalon.

@Toputnal done! avalonweb1s works with my ssh keys now!

from avalon.

@Toputnal avalonweb1s is the only one of those on the list I can log into with SSH keys.

from avalon.

from avalon.

@Toputnal

avalonweb2p - prompted for password but permission denied
libwowza1p - ssh: connect to host libwowza1p.library.northwestern.edu port 22: Operation timed out
libsolr1s - prompted for password but permission denied
libsolr1p - prompted for password but permission denied
libfedora1s - prompted for password but permission denied
libfedora2s - prompted for password but permission denied
libdb1s - prompted for password but permission denied
libdb1p - prompted for password but permission denied

from avalon.

Checked with @kdid and we think that most of these are now fixed. avalonweb2p and libwowza1p have firewall and or puppet issuses, so those may take a bit of hacking. Will update when those two are also set.

from avalon.

Ok. I think we should be set now. on everything.

from avalon.

@Toputnal the only server i'm still having issues with is avalonweb2p (i'm still getting prompted for my password)

from avalon.

it looks like this issue is being held up by: https://github.com/nulib/devops/issues/4

hopefully once that's resolved we can close this issue too

from avalon.

This is stale and problematic to the lack of a puppet fix. We should revisit developer permissions once the devops issue has been resolved and developers (including the new hires) can be added via puppet or we decom the machine in favor of an Avalon 6 machine. In the mean time we can get manual permissions in an emergency.

Clearing this off the board.

from avalon.