port auth-keys-from-fas to new account system #10509

New issue

Closed

opened 2022-01-28 09:09:54 +00:00 by praiskup · 16 comments

praiskup commented

2022-01-28 09:09:54 +00:00

Our playbooks fail to run /srv/web/infra/ansible/scripts/auth-keys-from-fas.

Our playbooks fail to run `/srv/web/infra/ansible/scripts/auth-keys-from-fas`.

praiskup commented

2022-01-28 09:14:37 +00:00

Author

I see I already touched this problem:

Nov 17 22:39:40 <praiskup>>-----weird failures in copr-be playbooks... nonfatal, but still .. traceback:
Nov 17 22:39:46 <praiskup>>-----Traceback (most recent call last):
Nov 17 22:39:46 <praiskup>>-----  File "/srv/web/infra/ansible/scripts/auth-keys-from-fas", line 17, in <module>
Nov 17 22:39:46 <praiskup>>-----    from fedora.client import AccountSystem, AuthError
Nov 17 22:39:46 <praiskup>>-----ModuleNotFoundError: No module named 'fedora'
Nov 17 22:39:50 <praiskup>>-----(on batcave01
Nov 17 22:41:04 <nirik>>ah whoops._
Nov 17 22:41:09 <nirik>>you are still using fas-clients?
Nov 17 22:41:23 <nirik>>I removed it from eveywhere, but I guess we need it back there?
Nov 17 22:41:44 <praiskup>>-----we use "add root keys for sysadmin-main and other allowed users"
Nov 17 22:42:08 <praiskup>>-----it is somewhat convenient to use root@ but if we have to live with sudo, ..._
Nov 17 22:42:59 <nirik>>ah... we need to fix that. we can easily change it to use ipa

I see I already touched this problem: ``` Nov 17 22:39:40 <praiskup>>-----weird failures in copr-be playbooks... nonfatal, but still .. traceback: Nov 17 22:39:46 <praiskup>>-----Traceback (most recent call last): Nov 17 22:39:46 <praiskup>>----- File "/srv/web/infra/ansible/scripts/auth-keys-from-fas", line 17, in <module> Nov 17 22:39:46 <praiskup>>----- from fedora.client import AccountSystem, AuthError Nov 17 22:39:46 <praiskup>>-----ModuleNotFoundError: No module named 'fedora' Nov 17 22:39:50 <praiskup>>-----(on batcave01 Nov 17 22:41:04 <nirik>>ah whoops._ Nov 17 22:41:09 <nirik>>you are still using fas-clients? Nov 17 22:41:23 <nirik>>I removed it from eveywhere, but I guess we need it back there? Nov 17 22:41:44 <praiskup>>-----we use "add root keys for sysadmin-main and other allowed users" Nov 17 22:42:08 <praiskup>>-----it is somewhat convenient to use root@ but if we have to live with sudo, ..._ Nov 17 22:42:59 <nirik>>ah... we need to fix that. we can easily change it to use ipa ```

praiskup commented

2022-01-28 10:18:21 +00:00

Author

How are we supposed to list the group, just?

$ getent group sysadmin-copr | cut -d: -f4
dkirwan,mizdebsk,praiskup,msuchy,schlupov,clime,frostyx

How are we supposed to list the group, just? ``` $ getent group sysadmin-copr | cut -d: -f4 dkirwan,mizdebsk,praiskup,msuchy,schlupov,clime,frostyx ```

kevin commented

2022-01-28 20:38:13 +00:00

Yeah, we should move away from fas-clientsetc.

So, yes for ssh keys for a group we could just do 'getent group name' and then for each name run 'sss_ssh_authorizedkeys name'

Should we make a script to do this? Or try and just do it in ansible?

Yeah, we should move away from fas-clientsetc. So, yes for ssh keys for a group we could just do 'getent group name' and then for each name run 'sss_ssh_authorizedkeys name' Should we make a script to do this? Or try and just do it in ansible?

praiskup commented

2022-01-28 21:34:27 +00:00

Author

Should we make a script to do this? Or try and just do it in ansible?

That would be awesome! I can take a look later, though for now I just disabled
those tasks (we already have the keys distributed).

> Should we make a script to do this? Or try and just do it in ansible? That would be awesome! I can take a look later, though for now I just disabled those tasks (we already have the keys distributed).

zlopez commented

2022-01-31 09:44:54 +00:00

Contributor

Metadata Update from @zlopez:

Issue priority set to: Waiting on Reporter (was: Needs Review)

**Metadata Update from @zlopez**: - Issue priority set to: Waiting on Reporter (was: Needs Review)

kevin commented

2022-02-22 20:38:10 +00:00

This could be a nice task for a new person. Just need to get groups passed to the script, find all the users in those groups with getent and then find all those users ssh keys with sss_ssh_authorized_keys and output the list.

kevin commented

2022-02-22 20:38:10 +00:00

Metadata Update from @kevin:

Issue priority set to: Waiting on Assignee (was: Waiting on Reporter)
Issue tagged with: easyfix, low-trouble, medium-gain, ops

**Metadata Update from @kevin**: - Issue priority set to: Waiting on Assignee (was: Waiting on Reporter) - Issue tagged with: easyfix, low-trouble, medium-gain, ops