infrastructure January 2011

infrastructure@lists.fedoraproject.org

35 participants
19 discussions

Lost access to retrace01 machine
by Michal Toman 05 Feb '11

05 Feb '11

Hi, after changing my (mtoman) FAS password and SSH key, I'm not able to SSH retrace01.fedoraproject.org anymore (pubkey, password). Login to fedorapeople and fedorahosted works correctly. Could you look at the problem and possibly renew my access? Thanks, Michal

3 3

Fwd: Permission denied (publickey)
by Tomas Lestach 04 Feb '11

04 Feb '11

Could anybody check the problem, please? It's been 8 weeks since I reported the issue. Regards, Tomas -- Tomas Lestach RHN Satellite Engineering, Red Hat -------- Original Message -------- Subject: Permission denied (publickey) Date: Thu, 02 Dec 2010 11:15:41 +0100 From: Tomas Lestach <tlestach(a)redhat.com> To: infrastructure(a)lists.fedoraproject.org Hello, my fedoraproject.org account is: tlestach My Roles are: * Signed CLA Group (user) * Fedora CLA Group (user) * Spacewalk Git Commit Group (administrator) When I try to upload a tar.gz to fedorahosted.org:spacewalk, I get: $ scp /tmp/tito/spacewalk-backend-1.3.20.tar.gz fedorahosted.org:spacewalk Permission denied (publickey). lost connection According to https://fedorahosted.org/web/faq, I shall have just a fedoraproject account and a CLA, what I have. I'm sure, my public key is correct, because I'm a member of one of the Git Commit Groups and I have no trouble with committing, where the public key get's verified. Is there something I miss? Regards, Tomas -- Tomas Lestach RHN Satellite Engineering, Red Hat

3 4

RE: New Fedora Mirror in Vietnam
by Matt Domsch 04 Feb '11

04 Feb '11

We would very much welcome you as a mirror. Please see http://fedoraproject.org/wiki/Infrastructure/Mirroring, and create an account for yourself in the Fedora Account System, and register your mirror in MirrorManager, our database, at https://admin.fedoraproject.org/mirrormanager . You can enter your own mirror there, and update your information as needed. Within 2 hours of adding your info to the database, you will start seeing traffic. If you have any questions, please let us know. Thanks, Matt Fedora Mirror Wrangler -- Matt Domsch Technology Strategist Dell | Office of the CTO -----Original Message----- From: mirror-admin-bounces(a)fedoraproject.org [mailto:mirror-admin-bounces@fedoraproject.org] On Behalf Of Gmail - Pham Duc Hoang Sent: Tuesday, December 21, 2010 9:11 PM To: mirror-admin(a)fedoraproject.org; fedora-infrastructure-list(a)redhat.com Subject: New Fedora Mirror in Vietnam Dear , We launched a new mirror for the project fedoraproject.org. You can add a mirror to the overall list. Below the information about mirror: * My Company : DIGIPOWER Co.,ltd * URL of mirror: http://mirrors.digipower.vn/fedora/releases * Country where the mirror is located: VietNam * Contact email address: support(a)digipower.vn , duchoang(a)digipower.vn * Update frequency: 4 times a day * Rsync repository used: mirrors.digipower.vn::fedora * Approximate bandwidth: 100Mbps * IP : 112.78.6.8 . * Service : HTTP - FTP - RSYNC * Available content : Fedora Linux 13 - 14 * Architectures : All Best Regards , _______________________________________________ Mirror-admin mailing list Mirror-admin(a)fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/mirror-admin

2 2

Support for BFO?
by Ray Van Dolson 02 Feb '11

02 Feb '11

Where is the proper place to seek support for BFO (boot.fp.org)? I didn't really see a component for it in Bugzilla, nor were there any contact links on the website or in the FAQ. I know it spawned out of Infrastructure, so also checked Trac -- that may be the right place but thought I'd ask here first. I have an issue with my NIC being supported. Probably can resolve upstream, but who here would need to be pinged to implement any changes? Thanks, Ray

5 6

Re: Security incident on Fedora infrastructure on 23 Jan 2011
by Jose Manimala 28 Jan '11

28 Jan '11

Awesome work and happy that nothing bad has happened. One question is should a password length and secure password creation check be enforced on the FAS system. Like regular expression checks and stuff. I know this is asking a lot, the current implementation allows me to have a simple password if I remember(need to check) been long. And password expiry? :) On Tue, Jan 25, 2011 at 1:14 PM, Jared K. Smith <jsmith(a)fedoraproject.org> wrote: > Summary: Fedora infrastructure intrusion but no impact on product integrity > > On January 22, 2011 a Fedora contributor received an email from the Fedora > Accounts System indicating that his account details had been changed. He > contacted the Fedora Infrastructure Team indicating that he had received > the email, but had not made changes to his FAS account. The Infrastructure > Team immediately began investigating, and confirmed that the account had > indeed been compromised. > > At this time, the Infrastructure Team has evidence that indicates the account > credentials were compromised externally, and that the Fedora Infrastructure was > not subject to any code vulnerability or exploit. > > The account in question was not a member of any sysadmin or Release Engineering > groups. The following is a complete list of privileges on the account: > * SSH to fedorapeople.org (user permissions are very limited on this machine). > * Push access to packages in the Fedora SCM. > * Ability to perform builds and make updates to Fedora packages. > > The Infrastructure Team took the following actions after being > notified of the issue: > 1. Lock down access to the compromised account > 2. Take filesystem snapshots of all systems the account had access to > (pkgs.fedoraproject.org, fedorapeople.org) > 3. Audit SSH, FAS, Git, and Koji logs from the time of compromise to the > present > Here, we found that the attacker did: > * Change the account's SSH key in FAS > * Login to fedorapeople.org > The attacker did not: > * Push any changes to the Fedora SCM or access pkgs.fedoraproject.org in > any way > * Generate a koji cert or perform any builds > * Push any package updates > > Based on the results of our investigation so far, we do not believe that any > Fedora packages or other Fedora contributor accounts were affected by this > compromise. > > While the user in question had the ability to commit to Fedora SCM, the > Infrastructure Team does not believe that the compromised account was used to > do this, or cause any builds or updates in the Fedora build system. The > Infrastructure Team believes that Fedora users are in no way threatened by this > security breach and we have found no evidence that the compromise extended > beyond this single account. > > As always, Fedora packagers are recommended to regularly review commits to > their packages and report any suspicious activity that they notice. > > Fedora contributors are strongly encouraged to choose a strong FAS password. > Contributors should *NOT* use their FAS password on any other websites or > user accounts. If you receive an email from FAS notifying you of changes to > your account that you did not make, please contact the Fedora Infrastructure > team immediately via admin(a)fedoraproject.org. > > We are still performing a more in-depth investigation and security audit and we > will post again if there are any material changes to our understanding. > > -- > Jared Smith > Fedora Project Leader > -- > announce mailing list > announce(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/announce > -- Cheers Jose http://josemanimala.eu.org/blog Ph: +64221033100

9 8

rpm -Va report
by Seth Vidal 28 Jan '11

28 Jan '11

As we talked about in the infrastructure meeting (and beyond) yesterday. I did a full rpm -Va run on every host we maintain. the results are on puppet1 in /var/tmp/global-rpm-va some of them are icko -sv

1 0

Meeting reminder
by Derek Carter 27 Jan '11

27 Jan '11

Yeah, it's last minute. We have a pretty full meeting item list on the trac: https://fedorahosted.org/fedora-infrastructure/query?status=new&status=assi… What other things do we need to talk about? -- Derek aka goozbach

1 0

Introductions
by Bassford John 25 Jan '11

25 Jan '11

Hello Fedora-Infrastructure I`d like to introduction myself, my name is John Bassford (irc jbass29503 on irc.freenode.net#fedora-admin) and was looking to learn the in/outs of how the fedora infrstucture group works and possible start to assist with small tasks/projects to assist the fedora project. I have been a sysadmin for about 13 years now, working both linux and windows sides. So please look at the info below which is what was recommended from the fedora-wiki, and don`t be in shock. Name: John Bassford Time Zone/Country: Eastern/US BasicSkills/Experiences: SystemAdministrator/Engineer, bash,perl, ldap,rpm packaging, nagios, dns admin, fimilar with puppet Developerskills: not really, know php, and a little java, but not python whyJoin: to give back to opensource community, learn new technology and ways, in general to boarden my horizons Looking to do: observe and get a feel of the infrastructure group and possible help with these two open tickets to start with, I think they are small and something good for someone new to the group to start with. (tickets 1152 and 1084 if there really is still work to be done for them, as these active tickets are rather old) an maybe the Nagios upgrade. (2275) HowMuchTime: couple hours a day and/or more on a weekend. I have some hardware to do simulated testing with, a dell server running vmware esx (freeware) which is what I just installed fedora14 on, but somewhat limited in disk space abou 100GB total local. Thanks JB

1 0

Methods for reducing spam
by Mike McGrath 23 Jan '11

23 Jan '11

We publish a lot of emails for various reasons, I thought I'd pass this along, it's worth a read: http://techblog.tilllate.com/2008/07/20/ten-methods-to-obfuscate-e-mail-add… -Mike

2 1

OUTAGE: PHX2 Network outage - 2011-01-25 02:00 UTC
by Stephen John Smoogen 20 Jan '11

20 Jan '11

There will be an outage starting at 2011-01-25 02:00 UTC, which will last approximately 3 hours. To convert UTC to your local time, take a look at http://fedoraproject.org/wiki/Infrastructure/UTCHowto or run: date -d '2011-01-25 02:00 UTC' Reason for outage: We are moving from older netapp to newer one due to hardware limitations and aging hardware. Due to change in disk architectures and such, we will be having a total outage of Fedora services. Affected Services: BFO - http://boot.fedoraproject.org/ Bodhi - https://admin.fedoraproject.org/updates/ Buildsystem - http://koji.fedoraproject.org/ CVS / Source Control Docs - http://docs.fedoraproject.org/ Email system Fedora Account System - https://admin.fedoraproject.org/accounts/ Fedora Community - https://admin.fedoraproject.org/community/ Fedora Hosted - https://fedorahosted.org/ Fedora People - http://fedorapeople.org/ Fedora Talk - http://talk.fedoraproject.org/ Main Website - http://fedoraproject.org/ Mirror List - https://mirrors.fedoraproject.org/ Mirror Manager - https://admin.fedoraproject.org/mirrormanager/ Package Database - https://admin.fedoraproject.org/pkgdb/ Smolt - http://smolts.org/ Spins - http://spins.fedoraproject.org/ Start - http://start.fedoraproject.org/ Torrent - http://torrent.fedoraproject.org/ Translation Services - http://translate.fedoraproject.org/ Wiki - http://fedoraproject.org/wiki/ Unaffected Services: DNS - ns1.fedoraproject.org, ns2.fedoraproject.org Contact Information: Please join #fedora-admin in irc.freenode.net or respond to this email to track the status of this outage. Ticket: https://fedorahosted.org/fedora-infrastructure/ticket/2571 -- Stephen J Smoogen. "The core skill of innovators is error recovery, not failure avoidance." Randy Nelson, President of Pixar University. "Let us be kind, one to another, for most of us are fighting a hard battle." -- Ian MacLaren

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure January 2011