[01:10:04] * legoktm pokes Damianz  [01:10:07] cluebot is down? [01:28:19] phe: You can still use qsub with happy fun -l h_vmem=$foo [01:28:39] phe: jsub is there for the newbies and the peeps who don't want to bother with qsub arcana. [08:24:11] legoktm is it? [08:24:53] @notify addwork [08:24:53] You already requested this user to be watched [08:25:18] It is [08:25:23] let me check [08:25:24] Since a loooong time ago [08:25:32] I have no idea how to restart it because there is no guide [08:25:36] !botsdocs [08:25:36] https://labsconsole.wikimedia.org/wiki/Nova_Resource:Bots/Documentation [08:26:03] last edit was [08:26:04] 20:25, 18 March 2013 (diff | hist) . . (-25)‎ . . m Nino Bravo ‎ (Reverting possible vandalism by 212.231.247.181 to version by Addbot. False positive? Report it. Thanks, ClueBot NG. (1561812) (Bot)) (current) [rollback: 1 edit] [rollback] [vandalism] [08:26:39] !botsdocs is https://wikitech.wikimedia.org/wiki/Nova_Resource:Bots/Documentation [08:26:39] This key already exist - remove it, if you want to change it [08:26:46] erm [08:26:51] !botsdocs del [08:26:51] Successfully removed botsdocs [08:26:54] !botsdocs is https://wikitech.wikimedia.org/wiki/Nova_Resource:Bots/Documentation [08:26:54] Key was added [08:47:32] * Beetstra does not understand anything of perl's setrlimit ... :-( .. his modules don't crash when he tests them with low values [08:52:08] * Beetstra looks at Coren|Sleep  [08:52:33] Coren|Sleep .. I think that the RSS memory limits are not implemented and hence ignored by the OS [09:23:15] !log deployment-prep created sudo policy for jenkins-deploy user. That is the user for the Jenkins slave running deployment-bastion [09:23:18] Logged the message, Master [09:37:41] [bz] (ASSIGNED - created by: Antoine "hashar" Musso, priority: Immediate - normal) [Bug 45084] autoupdate the databases! - https://bugzilla.wikimedia.org/show_bug.cgi?id=45084 [10:01:42] !log bots root: mysql: btrfs filesystem resize -10G /db [10:01:44] Logged the message, Master [10:03:07] !log bots root: running online fsck [10:03:08] Logged the message, Master [10:05:28] o.O? [10:13:04] !log bots root: created /logs_db for binlogs [10:13:06] Logged the message, Master [10:13:33] !log bots root: houston filesystem /db is broken - new kernel is needed to fix it [10:13:34] Logged the message, Master [10:13:55] !log bots root: mysql is running fine though - just btrfsck is crashing [10:13:57] Logged the message, Master [10:20:17] !log bots root: restart of mysql is needed to update configuration [10:20:19] Logged the message, Master [10:28:51] !log bots petrb: updated some packages on sql [10:28:53] Logged the message, Master [10:31:00] btrfsck /db [10:31:03] awesome XD [10:31:20] Damianz that filesystem is kind of borked :P [10:31:29] I mean so borked that fsck is crashing [10:31:30] :( [10:31:37] but on other way it seems to work [10:31:44] mysql is not reporting any issues [10:31:52] so maybe this is problem with some metadata [10:31:56] which aren't important [10:32:13] btw I was amazed by speed of btrfs online shrink [10:32:17] took like 2 seconds [10:32:18] :P [10:32:49] we really need 3.8 kernel on that box [10:35:07] lol btrfsck is crashing is similar way even on my laptop with 3.8.1 kernel [10:35:15] I think this is some common problem then [10:46:15] petan, it seems that the box does not care about the memory-limits of the processes [10:46:18] Damianz if you want to move binlogs we need to schedule outage of sql [10:46:32] Doesn't need to move right now - just stop the disk filling [10:46:32] Beetstra which box? [10:46:38] Damianz sure I already did [10:46:40] whichever [10:46:51] Beetstra did you supply the limit using qsub? [10:46:53] the bot that I am using to test runs on -bnr3 [10:46:58] Beetstra I am really no expert of grid, Coren|Sleep is [10:47:27] Beetstra but there are no real memory limits configured per queue now, so if you need some you would need to specify them per task [10:47:48] I have specified them in perl for the specific modules .. [10:47:48] btw on -bnr3 there is sooooo much free ram atm [10:47:54] not for the whole task [10:47:54] ah [10:48:01] in that case it's problem of perl [10:48:06] maybe there is some library missing? [10:48:18] I just say, 'this perl module is not allowed to use more than 20M' .. but it happily uses 34M [10:48:33] #perl-people say that it is that the box does not care .. [10:48:59] that sounds weird - the box doesn't care because it's not supposed to, there are no memory limits atm [10:49:00] It just does not send a SIGKILL to the processes that violate [10:49:18] it should be that perl module watching its own usage [10:49:25] The script sets them correctly [10:49:36] box will not send sigkill because the box itself has no problem with processes eating lot of ram [10:49:36] No, because it tells the BSD [10:49:57] hmm [10:50:05] maybe it's some system option that needs to be set? [10:50:11] is there some manual for that perl function [10:50:13] I am using BSD::Resource::setrlimit [10:50:25] cpan, BSD::Resource [10:50:34] http://search.cpan.org/~jhi/BSD-Resource-1.2904/Resource.pm [10:50:34] are you sure it doesn't require something that isn't installed? [10:50:51] I installed the perl module in cpan, otherwise it will not run [10:51:02] hmm [10:51:09] maybe we could install it using apt everywhere [10:51:11] what is name [10:51:16] lets wait for Coren [10:51:47] * Beetstra pulls the bucket of ice cold water a bit closer to Coren [10:52:56] it says in the cpan-resource: "Soft or hard limit RLIM_INFINITY means as much as possible, the real hard limits are normally buried inside the kernel and are very system-dependent." [10:52:57] I don't know if coren is perl guy [10:53:16] well, should be the same on python, way of doing this is exactly the same [10:53:17] this is definitely something related to perl and not grid [10:53:32] At least, the code I saw yesterday is quite the same [12:45:31] The sleeper has awakened. Somewhat. (pre-coffee) [12:46:46] !Beetstra [12:46:49] Hey, Coren [12:46:52] Good morning [12:46:59] Woes of memory? [12:47:06] kind of [12:48:10] I have in each module the line "my $success = setrlimit(RLIMIT_RSS, $settings{'xxxx.memlow'},$settings{'xxxx.memhigh'});" [12:48:24] and reading out those values shows that they are set appropriately [12:48:35] But to whatever value I set them, the module never crashes [12:48:43] (perl-code) [12:49:23] in #perl they suggested that the box may not support it? [12:49:39] question is "what" is it not supporting [12:49:45] in terms of UNIX not terms of perl [12:50:07] in a way a good question [12:50:30] RLIMIT_RSS is an odd duck that doesn't behave like most people want. [12:50:35] You want RLIMIT_AS [12:50:36] oh [12:51:06] RLIMIT_RSS is only about locking memory down with madvise() (for things like crypto) [12:51:06] "(virtual) address space" ?? [12:51:13] Beetstra: Right. [12:52:07] But that doesn't get your process killed regardless; hiting a memory limit just makes sbrk() fail (perl, though, dies if it fails to allocate memory IIRC) [12:56:48] the module crashes with "Out of memory!" [12:57:10] !log bots madman: deleting bots-2 [12:57:11] Logged the message, Master [12:57:24] so that works .. in perl [12:57:25] Not very polite error handling, but it's working. [12:57:29] !log bots petrb: previous message was supposed to be logged as me [12:57:30] Logged the message, Master [13:03:04] hmm, interesting .. "libgcc_s.so.1 must be installed for pthread_cancel to work" [13:25:57] Beetstra: That's a symptom of low memory. [13:26:15] Beetstra: Ze limit. She is tooo smalle! [13:26:16] yeah, I knew I was there between the limits [13:26:34] Hey .. Italian accents are for my wife to produce ;-) [13:26:50] *lots* of code is written presuming that memory allocation cannot fail. Lots of lazy programmers. [13:27:35] I see the use of it, so I am trying to implement it now [13:28:05] Oh, I don't mean you. Even in system libraries of language interpreters you see that. [13:28:07] and for the others on the same instance: "Thou shall not pass!!!!" (.. this memory limit) ;-) [13:29:16] It is also for me, learn new things with this [13:31:27] I'm a (realy) old school coder; I still believe in being careful with not wasting core memory and carefully desinging code to keep a low footprint. The kids, these days, they spout the current common wisdom at me "ram is cheap, coder time is expensive", and then waste days tracking down problems. :-) [13:32:48] I am just a hobby-programmer, but writing the linkwatchers is something that needs to run optimally if you want the data in real time [13:32:59] If only the mediawiki software would record the data itself [13:33:23] Beetstra: Why not write an extension for MW? [13:34:04] Jan_Luca .. that would take so much time .. which I don't have [13:34:20] This is something that runs and I just need every now and then an hour or so to tweak [13:36:14] Coren, so now what happens. Say, I have a process that takes currently 50 Mb, with a hard-limit of 250 Mb. Someone else runs a rogue bot .. will that bot run out of memory when it hits the outside of my 250 Mb hard limit, because my process has the right to use that 250 even if it does not? [13:37:49] Beetstra: Nope. On a grid that enforces those limits, the others won't encroach on you because they hit /their/ limit before they can. [13:38:13] Beetstra: the rlimit doesn't allocate, it constrains. [13:38:26] So it takes only one rogue bot to still take down mine [13:39:07] Beetstra: Yes, unless the scheduler applies a limit to everything and doesn't overallocate. [13:39:28] OK [13:39:37] Beetstra: Which is why tools- is configured that way, unsurprisingly enough. :-) [13:41:16] overcommit_memory is set to 2 in tools- instance ? [13:44:25] phe: Yes, that too, but I meant the gridengine sets and enforces vmem-based allocation. [13:47:36] !tooldocs [13:47:36] http://www.mediawiki.org/wiki/Wikimedia_Labs/Tool_Labs/Help [13:47:49] Coren can you tell me how you configured the limits on grid [13:48:03] or is it documented somewhere [13:48:22] petan: I have, the other day, you just didn't notice. Make h_vmem consumable, and set a limit on the nodes. [13:48:38] nodes? I thought limit is on queue [13:48:53] that would mean that different nodes could have different limits? o.o [13:48:56] petan: You can have limits on either, but h_vmem makes no sense on queues. :-) [13:49:09] ah [13:49:32] ok, so... you specified some default limit? and users can override it? [13:49:36] petan: Yes. You'd obviously put the "real" amount of memory on the nodes (usually, you'd want physical-1G) [13:49:38] by specifying different value? [13:49:53] petan: Right. The default is just convenience. [13:50:08] ok, users can override it how they want or is there a limit too? [13:50:22] so you just set h_vmem to 256mb on nodes? [13:50:42] No, the setting on the node is the total quantity available. [13:50:47] Like, "7g" [13:50:57] ah [13:51:04] so where you set the 256mb? [13:51:53] In /var/lib/gridengine/default/common/sge_request. Default values to there. [13:51:58] ok [13:52:01] s/to/go/ [13:52:35] (simple text file with one option per line so) [13:52:47] -l h_vmem=128m [13:52:49] (on one line) [13:52:53] ok [13:52:57] Err, 256m [13:53:07] 128 was my first attempt. Too small for python. [13:53:32] this should be in puppet variable so that we can use it on staging with same values [13:54:05] petan: Hm. I was planning on just putting the sge_request file in puppet. [13:54:19] we could either put whole config to puppet but that would complicate it to play with it on staging in order to test different conf [13:54:36] because puppet would just override it [13:54:39] whole [13:55:09] petan: Not unreasonable. [14:01:08] btw Coren qtop is working on your grid as well... [14:01:24] or it appears to me to work :P [14:02:26] just cp -r /home/petrb/bin ~/bin [14:05:06] petan: I'll stuff it in /usr/local/bin. Want to go doc it on the help page, then? [14:05:48] sure [14:06:11] I see it needs qdisplayinfo.sh as well. [14:06:30] Do you intend that one to be directly usable as well? [14:06:33] well, we could probably merge it [14:06:45] qdisplay print the info once [14:06:52] qtop refresh it every second [14:07:01] qdisplay has that advantage it works in small screen [14:07:09] while qtop will not display all text in small terminal [14:07:20] qtop is just a wrapper for qdisplay [14:07:30] Hm. Okay, I'll rename it to qdisplay then [14:07:34] ok [14:07:48] Coren: BTW, it would be nice if *all* scripts & Co. have at least a one-liner licence so that there's no ambiguity. [14:08:00] scfc_de: Oh, good point! [14:08:01] feel free to use any licence you want... [14:08:10] I am fine with WTFPL :P [14:08:18] or GPL [14:08:41] They're minuscule. I was thinking CC-0 [14:09:08] I think WTFPL is even more liberal than CC-0 :P [14:09:09] Or DWTFWIWI :-) [14:09:17] that's probably same [14:09:21] just longer name [14:09:40] Yeah, CC-0 is... nicer. :-) [14:09:50] Most of the scripts probably aren't copyrightable at all :-), but it's much nicer to sort this stuff out now then in five years when noone remembers who did what. [14:10:59] Coren what is that "Why" header for [14:11:08] * "How" [14:11:13] 2.1 How [14:11:14] 2.2 Simple utilities [14:11:19] section 2.1 has no text [14:11:48] Yeah, I'm not done yet. I want to give a summary of how submitting jobs work and what happens to them. [14:12:04] ok maybe that qtop could go there in future [14:12:08] no idea where to put docs for that [14:12:18] it should be in "grid status" section or whatever [14:12:23] or grid status overview [14:13:06] * Coren asks WMF legal for the right boilerplate. [14:13:47] petan: bots-bsql01 down? [14:13:55] Damianz since when? [14:14:11] It pings but I can't connect to mysql or ssh to it [14:14:18] o.O [14:14:22] Bot last reverted something 2 hours ago [14:14:38] let me check [14:14:48] I can't ssh either :/ [14:14:48] [611760.713140] INFO: task mysqld:16620 blocked for more than 120 seconds. [14:14:51] [611760.713755] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [14:14:54] *snort* [14:15:07] I think it's a good time to schedule our restart of mysqld then :> [14:15:28] the box probably [14:15:48] !log bots -sql has some troubles - Damianz is responsible for sure :P [14:15:50] Logged the message, Master [14:16:03] wait [14:16:07] don't reboot it yet [14:16:13] I would like to find out what happened [14:16:48] * Damianz gives you 30min [14:16:57] I am there :> [14:16:58] sshed [14:17:10] but still launching local shell [14:17:50] hehe load 143 [14:18:25] That would be why the process is hung [14:18:38] !log bots mysql db ate 31gb of ram [14:18:39] Logged the message, Master [14:18:46] that needs some investigation [14:18:55] I am stopping mysqld now [14:19:08] !log turning off mysqld to fix ram problems and moving binary logs [14:19:09] turning is not a valid project. [14:19:13] !log bots turning off mysqld to fix ram problems and moving binary logs [14:19:14] Logged the message, Master [14:19:56] Anyone currently using the tools- queue? I should reboot to reapply some security updates. [14:20:26] Coren not me and qtop is telling me 0 jobs are running [14:20:38] not that qtop is trustworth :P [14:20:59] Damianz wow it takes some time to kill a process that eats 30+gb ram [14:21:27] !log tools reboot cycle (all instances) to apply security updates [14:21:28] Logged the message, Master [14:21:29] it just doesn't want to die [14:22:20] petan: Ah, the joys of swap. :-P [14:23:04] !log bots killing mysqld with -9 :| [14:23:05] Logged the message, Master [14:23:28] !log bots not that it would really worked :P [14:23:29] Logged the message, Master [14:25:18] Unable to parse the feed from https://bugzilla.wikimedia.org/buglist.cgi?chfieldfrom=-4h&chfieldto=Now&list_id=151044&product=Wikimedia%20Labs&query_format=advanced&title=Bug%20List&ctype=atom this url is probably not a valid rss, the feed will be disabled, until you re-enable it by typing @rss+ bugzilla [14:25:36] These are just "user databases", aren't they? [14:26:28] !log bots root: restarting mysql server with new configuration [14:26:29] Logged the message, Master [14:28:01] !log bots started recovery of innodb.. will take some time [14:28:03] Logged the message, Master [14:28:28] that maria doesn't want to start, seems like data are corrupt [14:28:35] fortunately we have binary logs :> [14:29:43] kill -9 can cause some damage. [14:29:51] Bots back up anyway [14:36:08] !log bots recovery finished, db is back :)) [14:36:10] Logged the message, Master [14:36:55] andrewbogott: hey :-]  Your puppet documentation root page seems to use Twitter bootstrap now https://doc.wikimedia.org/ =) [14:37:25] andrewbogott: well at least the main page. The index file is somewhere under integration/docroot.git . I guess we will happily co maintain it [14:37:32] scfc_de be sure I don't use kill -9 unless I have to :/ [14:37:49] that box would die on OOM if I didn't [14:39:04] hashar: I don't know enough about css to know what 'Twitter bootstrap' means... [14:39:13] That front page should probably become a wiki page, someday [14:39:50] andrewbogott: maybe yeah :-] [14:43:40] Damianz I am thinking of killing some swap on bsql01 and using that for lvol2 but not sure if that is a good idea [14:43:58] meh... why we just can't have another virtual disk plugged to instance [15:03:46] !log nagios petrb: restarted ircecho [15:03:47] Logged the message, Master [15:04:22] !ping [15:04:23] pong [15:08:41] Coren: I have added to my list some questions for a sysadmin doc of tools: https://wikitech.wikimedia.org/wiki/User:Jan/Tools#Sysadmin_doc [15:10:13] Jan_Luca: Indeed, those are important questions. [15:11:49] Coren: Maybe petan could add questions he has [15:12:25] Jan_Luca: That would be wise indeed. :-) *hint, hint* [15:36:47] Coren: You write in your documantion only about CGI. Is FastCGI installed, too? [15:38:31] Jan_Luca: suphp; I know of no reliable way to deploy FastCGI in a compartimentalized fashion. [15:40:39] Coren: suexec? [15:42:17] Jan_Luca: That's explorable as a technique. There's also the problem that I would very much prefer to not have long-running processes run on the webservers. It's in the "would be nice - will look into it" slush pile. [15:43:25] * Coren would idealy prefer a scheme by which the fastcgi app runs on the grid, but that would require some unix socket /wedge/ on the webserver. Not impossible, just not trivial. [15:43:59] Coren: But if there are tools using cgi with high access, every time a new cgi process will be created [15:44:16] Hence "would be nice" :-) [15:45:25] Remote FastCGI would work, but the lack of certificates means that insulation is hard. [15:48:11] Coren: Maybe you could ask the Toolserver roots how they have set up FastCGI [15:48:30] Jan_Luca: I already know, by allowing the actual app to run on the webserver. [15:48:46] Jan_Luca: Which I do not want to do here for stability and security. [15:49:09] Coren: But using cgi makes no difference [15:49:33] Jan_Luca: In theory, it's not /especially/ hard to do it; but it takes some effort and it's not clear to me how many people need/use it. [15:50:01] Jan_Luca: Yes, but CGIs are short lived, and do not survive the connection; the issues with persistent daemons are not the same. [15:50:43] Jan_Luca: If you think there is a serious call for FastCGIs, I can arrange it. I just didn't think there'd be that much demand for it. [15:50:44] Coren: When I unterstand you right you want to create a FastCGI daemon on another host like php-fpm? [15:51:06] Jan_Luca: Yes, using the gridengine for creation and dispatch. [15:51:34] Coren: Ah, you want to use proxy_fastcgi, now I get it [15:53:51] Not quite, actually, but the same principle. (proxy_fastcgi is really hard to do right without sysadmin intervention to the apache configs, I want something the maintainers can do themselves) [15:54:29] Coren: A small wrapper that calls the right process? [15:55:09] Right, so that the fastcgi server is started on the grid instead of locally. [15:56:12] Coren: Ok, you're right, that would be a better way to enable FastCGI than my idea [16:05:44] Jan_Luca: Which Toolserver apps use FastCGI? [16:06:20] scfc_de: I don't know but maybe there are some [16:07:53] Jan_Luca: Then I'd suggest that we wait until someone actually requests it :-). [16:08:25] scfc_de: I only want to have a high compatibility to Toolserver :-) [16:12:23] Jan_Luca: I don't. I hope Solaris dies. I hope JIRA dies. I hope all the other cruft that has accumulated over the years dies. I hope for reliable, responsive, usable replicated databases. [16:15:21] scfc_de: I don't mean the thing you listed, I think of webserver envirment, SGE, ... [16:15:40] You're right that some thing should not be migrated [16:20:18] Jan_Luca: But FastCGI that - for the sake of this argument - isn't used, should be migrated? Every astray from a "standard" setup means not only admin work setting it up, but also maintaining it and debugging it. We've seen at Toolserver how a plethora of seldomly used services makes admin work unnecessarily complex. [16:21:42] scfc_de: I thought FastCGI is used because not everybody likes PHP and FastCGI is IHMO better than CGI [16:22:28] Jan_Luca: Do you use FastCGI? :-) [16:23:15] scfc_de: No, because I like PHP. ;-) [16:23:37] I only want to create a nice envirment for everybody [16:23:56] I tried tu use fcgi with pyton on the TS and fallback to cgi as I was unable to get something working [16:24:52] Jan_Luca: Then you probably have some expertise in deploying PHP apps and can help Coren in this regard. [16:25:08] phe: Eh, did FastCGI work or not? [16:25:37] scfc_de, I don't remember if the problem was on my side or on TS side :) [16:27:18] I suppose it's really mostly a matter of "does anyone /use/ it?" [16:27:33] phe: I never touched FastCGI as IIRC a FastCGI process is destroyed after a few seconds so it would only be useful for *really* heavy use while requiring a lot of rewriting the app. Also, it would have required me to set up FastCGI on my local box as well. [16:27:50] scfc_de: I already asked Coren where I can help [16:28:10] I mean yes, I know ostensibly FastCGI is a better design, but unless people actually do use it, the effort of another component isn't a good idea. [16:28:25] The fewer things that are in place, the fewer things that can break. :-) [16:28:54] He answered that at moment the best help would be things like questions for his documentation [16:29:26] Jan_Luca: Sure, but if you find some needed component you have expertise with, help is always welcome. [16:30:35] Jan_Luca: I meant finding any hiccups in the PHP setup that make app deployment more difficult/impossible. [16:31:48] Jan_Luca: (And if you don't find any, that's not a failure on your part.) [16:32:48] scfc_de: At moment I have no good tools to test the system [16:33:24] I help at moment developping MW itself when I have time [16:33:34] Jan_Luca: Don't you maintain one of Magnus' tools, Commonshelper or something like that? [16:34:35] scfc_de: Yes, but since the Commons' admins disabled my bot the usbility is not as I want to [16:36:31] and it needs some review at moment [16:36:32] scfc_de: And CommonsHelper2 would need a replacement for TUSC to enable auto-uploads [16:38:28] scfc_de: And a replacement for TS-I18N ;-) [16:38:57] I have to rewrite some parts to get it running on Tools... [16:39:37] Jan_Luca: I think you should be able to port TUSC 1:1 to Tools (perhaps renaming it) if the wait for OpenID is too long. But I would fix the Commons issues before. A bot that is disabled on its wiki needs some work. [16:41:07] scfc_de: The tools itself works without the bot but it would be nicer when the auto-upload works [16:41:54] And TUSC is a tool of Magnus, he have to copy the database, too [16:43:05] Jan_Luca: Well, as a user, I wouldn't care if /some/ part of a tool works, if overall it fails :-). For Tools User Screening Tool, you would obviously need to set up a new database and new credentials. [17:17:08] gerrit-wm seems to have a problem... [17:27:43] <^demon> Jan_Luca: Known, have a patch up for it. [17:27:49] <^demon> It's restarting each time puppet runs. [17:36:46] Coren, Ryan_Lane, I'm making progress on the gui for service groups. Do you have time to work on the other bits today? [17:37:13] I'm imagining that Ryan_Lane will make the Schema changes and Coren can do whatever magic is required to actually implement things on the instances. [17:42:00] andrewbogott: o/~ it's some kind of magic o/~ [17:42:08] (Sorry, was in a meeting with CT) [17:43:16] Coren: This is what I have, so far… https://wikitech-test.wmflabs.org/wiki/Special:NovaProject [17:43:33] Ugly but consistent [17:44:13] andrewbogott: Yeah, I'll do the instance implementation part thing as soon as I have confirmation of the schema. [17:45:00] andrewbogott: I can't seem to create a TEST Coren account on the test [17:45:31] Hm, what does it tell you? [17:46:00] There was either an authentication database error or you are not allowed to update your external account. [17:47:53] Coren: I just now created an acount successfully. So… maybe TEST Coren already exists? [17:48:50] There is no user by the name "TEST Coren" [17:49:11] (Trying to passwd reset) [17:50:02] Same with case variations. [17:50:29] Hm. [17:50:36] ... o_O [17:50:40] Um… you can log into nova-precise2 to debug, or just skip it for now :) [17:50:43] and creating an account just worked now. [17:50:49] Oh, well then! [17:51:08] No Nova credentials found for your account. (in a really BIG font) [17:51:34] You can discuss the font with Ryan; I'm not a big fan of that theme. [17:51:56] Let's see… for on thing you'll need to to run on two factor auth in order to do anything interesting. [17:52:00] :D [17:52:03] Also, I think I need to set a flag for you, lemme look. [17:52:17] Coren, you're using 'TEST Coren' as your username? [17:52:34] andrewbogott: Yep [17:52:38] we can switch the theme back if you'd like. it's for testing [17:52:51] No, it's pretty. Just a bit... unusual. [17:53:05] the font sizes need to be adjusted [17:53:14] and the whitespace is a little weird [17:53:36] I say. I think 72-odd points for "Access denied" looks a bit too much like MovieOS. :-) [17:53:41] heh [17:53:46] it's a h1 [17:53:50] *an [17:54:05] but yeah, the font sizes are huge [17:54:16] this has saner font sizes: https://wiki.openstack.org/wiki/Main_Page [17:54:18] it's the same skin [17:54:24] different css [17:54:36] Big fonts for the camera [17:54:36] I also adjusted its whitespace [17:54:55] for instance: https://wiki.openstack.org/wiki/Special:RecentChangesLinked/Main_Page [17:54:56] normal sized h1 ;) [17:55:11] It does. I do like the sober black bar. [17:55:12] still larger than mediawiki's defaults, though [17:55:20] yeah, I like the black theme [17:55:31] this lighter theme goes better with openstack's other apps. though [17:55:31] * andrewbogott still likes sidebars better than pulldowns [17:55:38] but can adjust [17:55:48] sidebars waste so much space :) [17:55:57] maybe if the sidebar was hidable [17:56:03] andrewbogott: I use my ipad a lot. Sidebars are a pain. [17:56:21] Coren, you just need to rotate your ipad by 90 degrees [17:56:37] Aren't pulldown menus also a pain, on a touch device? [17:56:41] Ryan_Lane: The best thing, of course, would be if that bar was absolute floating at the top. :-) [17:56:44] not ones that stick [17:56:46] like this one [17:56:49] did someone say mobile? [17:56:55] YuviPanda: hahaha [17:57:02] do you have a ping on the word mobile? :) [17:57:04] YuviPanda: Do you actually stalk "mobile"? :-0 [17:57:10] YuviPanda: we were discussing the strapping theme [17:57:22] no, I'm using LimeChat, it has this nice stalking feature. [17:57:34] it scrolls messages from all channels on a secondary pane right under my primary one [17:57:37] so... :) [17:57:46] Ryan_Lane, I have the feeling I could be using projectadmin-create.py to give coren privs on nova-precise2… ? [17:58:01] * YuviPanda reads backscroll on strapping [17:58:26] andrewbogott: maybe I'm not totally sure it worked without some tweaks to the ldif file it generates [17:58:49] damn, I thought we switched wikitext to strapping theme [17:59:02] if you give him cloudadmin rights he can give himself projectadmin [17:59:29] maybe bureaucrat too [17:59:38] Actually, I just tried wikitech-test on my ipad and it's pretty nice. If the fonts were just a wee bit smaller and the top bar stuck to the top of display, I'd use it by default. [17:59:40] I hate that word. it's such a pain to type without typos [18:00:03] yeah. it's adaptive [18:00:10] so it automatically adjusts to the screen size [18:00:38] the fact that I suck at frontend work, but can make a non-shitty skin speaks highly of bootstrap :) [18:01:01] +1 ^ [18:01:22] Ryan_Lane: Bootstrap 3.0 is around the corner [18:01:27] \o/ [18:01:48] Ryan_Lane: http://rc.getbootstrap.com/ [18:01:51] is 'mobile first' [18:02:15] hmm, wrong link [18:02:53] Ryan_Lane: hmm, https://github.com/twitter/bootstrap/pull/6342 [18:02:56] drops IE7 suppport [18:03:13] well, that would make it difficult for us to adopt [18:03:36] to say the least, yeah [18:03:47] would that hinder adoption on even wikitech? [18:03:49] bleh. [18:03:59] I guess bootstrap currently already dropped IE6 support [18:04:18] Ryan_Lane: also ff 3.6 support :| [18:04:27] I'm not sure I want to add bootstrap to wikitech if we will never use it in production [18:04:39] yeah, [18:04:43] I can understand that [18:04:49] but if it is dropping IE7 support... [18:04:55] Ryan_Lane, can you give me a usage hint about projectadmin-create.py ? [18:05:06] I'm unsure how that bodes for us adding it in production in the next... 5-7 years? [18:05:14] andrewbogott: why use that, rather than just giving him rights via the interface? [18:05:29] then he can give himself rights as necessary [18:05:58] that script outputs ldif, and I think it's ldif is slightly wrong [18:05:58] *its [18:06:03] YuviPanda: heh [18:06:11] YuviPanda: well, we could continue to use bootstrap 2 :) [18:06:21] Ryan_Lane, oh, didn't know I could grant such privs. Much easier. [18:06:51] Ryan_Lane: well, bootstrap 2.0 doesn't support IE6 [18:06:52] https://github.com/twitter/bootstrap/issues/76 [18:06:56] but I'm completely fine with that :D [18:07:00] Coren, can you see the page I linked yet? [18:07:01] heh [18:07:18] andrewbogott: There were no Nova credentials found for your user account. Please ask a Nova administrator to create credentials for you. [18:07:30] Coren: log out and back in [18:07:32] Coren, did you turn on two-factor auth? [18:07:53] there's a bug on first login after account creation [18:08:06] that really needs fixing [18:08:07] andrewbogott: ... no. [18:08:10] * Damianz grumbles at crapy ux [18:08:24] Damianz: obviously [18:08:30] Coren, I think most project admin stuff requires two-factor. Although in theory it will tell you that. [18:08:35] it's non-trivial to fix [18:08:37] It does, now. [18:08:40] Mleh. [18:08:49] I don't mind two-factor. I hate your second factor. :-) [18:08:58] eh? you'd prefer sms? [18:09:03] * Ryan_Lane pukes [18:09:11] postal mail, duh. [18:09:14] :D [18:09:16] I'd love a Yubi key as an option [18:09:23] YuviKey? [18:09:43] * YuviPanda leaves the adults to their discussion [18:09:49] meh. I don't want to add any more authentication options [18:09:52] * Damianz gives YuviPanda that look [18:10:09] hey, I can make one bad joke a day! [18:10:18] OATH is available on basically every mobile device [18:10:36] What about my nokia 6410? [18:10:53] is it a feature phone? [18:10:58] does it support java me? [18:11:11] if so, then yes [18:11:11] Nope it's a brick used for when I'm in sandy places [18:11:17] then no, you're screwed [18:11:33] there's desktop apps too [18:11:54] oreally [18:11:57] I didn't know that [18:12:02] if you can't access your two factor, then you probably shouldn't log in ;) [18:15:48] andrewbogott: I haz a success. [18:16:47] andrewbogott: Ah, you're putting it directly on the project admin page. Makes sense. [18:18:11] If it fits... [18:18:13] andrewbogott: So, Openstack question; can you call a hook of mine or do I need to watch for LDAP changes? [18:18:32] andrewbogott: Like, you know, with salt [18:18:53] We don't have good salt integration at the moment, so you'll need to poll or use a puppet hook or something [18:19:40] Polling works, if a bit uglies. [18:20:05] It does have the advantage of being flexible. [18:20:47] I believe you can also poll by modification time [18:21:23] Ryan_Lane: Would the modification time propagate up the hiarchy? [18:21:40] no clue, but does it matter? [18:22:03] Ryan_Lane: If I can't just watch the whole OU, then I might as well just ldapsearch and diff. [18:22:32] well, you don't watch [18:22:42] you use a daemon, then when you poll, you request from the last timestamp [18:22:44] By "watch" I meant "compare modification time" [18:23:11] we do full searches every time. I'd kind of like to switch to using modification time [18:23:17] it's more efficient [18:23:27] It would be. I don't think I ever did that. [18:23:34] * Coren goes to find doc and read. [18:24:14] god damn it [18:24:20] I can't find a list of operational attributes [18:24:23] it's so annoying [18:24:33] why does every directory server make these hard to find? [18:24:41] Ryan_Lane: Could you explain me what the difference is between OAuth und OATH [18:25:40] Jan_Luca: OATH defines http://en.wikipedia.org/wiki/HOTP and http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm [18:26:13] both of which are used for one-time passwords [18:26:19] (two-factor authentication) [18:26:42] oAuth is a mechanism for allowing another application to act on your behalf, using tokens [18:27:30] so, flickr could upload images directly to commons, using your account, if you allowed it to do so, using oAuth [18:28:58] Ryan_Lane: OK, thank you. Do you have a advice which client should I use on Android? [18:29:29] google authenticator thing works great [18:29:47] yep [18:29:54] that's a good app for it [18:30:30] Ok, I will try it [18:32:46] Ryan_Lane: Did we ever decide what we do about sudoers for the service accounts? [18:33:15] Ryan_Lane: I can maintain a local sudoers from the info I scrape off LDAP, but I know you had another idea? [18:36:06] Damianz, Ryan_Lane: Thank you it works fine but can I use 2 devices for this [18:36:43] Pretty sure it works with 2 devices, not actually tried tbh [18:36:51] They use the same algo/key so it should work in theory I guess [19:04:02] Coren: why a local sudoers? [19:04:15] Coren: all of the instances are configured to use the project sudoers in ldap [19:04:29] if you add a policy, it'll be enabled on the instances automatically [19:04:45] the email I sent mentioned what we can do [19:04:54] Ryan_Lane: It makes customization easy. Remember, in my case, I have rules of the type "%local-anagrimes ALL=(local-anagrimes) NOPASSWD: ALL" [19:04:57] when a service user is created, a policy is automatically added for it [19:05:03] Ah, that works. [19:05:11] * Coren doesn't remember that email, though. [19:05:42] "Per-project service users and groups" in labs-l [19:06:15] Ah. I hadn't even noticed you talking about sudo. :-) [19:06:22] So yeah, this answers that. :-) [19:06:48] heh [19:15:16] Ryan_Lane: I have some time now for chatting. Yesterday, you proposed to me to show a warning, if a user fetches a page SpecialOpenIDIdentifier/id where (id != $wgUser->getID() || !isUser( id) ) [19:15:59] or positive: only to show him "this is your id page" if id === $wgUser->getID() [19:16:27] Shall I code that ? [19:16:32] It is easy [19:17:19] see https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/extensions/OpenID.git;a=blob;f=SpecialOpenIDIdentifier.body.php;h=d8270c4c4e63602fc3a00124feff3aa923ea1498;hb=HEAD#l61 [19:17:45] ... until line 111 [19:18:18] Ryan_Lane: [19:18:21] ^ [19:19:25] so, one of two things is occurring if the logged in user doesn't match the auth url [19:19:31] 1. Someone is being nasty [19:19:59] 2. Someone has more than one account, and they didn't realize they were already logged in with one of them while trying to use the other [19:20:30] #2 is pretty problematic because people may accidentally associate the wrong account to an application [19:20:37] well, there's also #3 [19:20:52] someone is using another person's computer and they try to login using their user page [19:21:12] can I answer now ? [19:21:16] sure [19:21:27] well, first at all, I wanted to fix this problem: [19:21:35] when someone crafts the url manually [19:21:47] there should be a page output [19:21:50] ok ? [19:21:57] yes. saying this user doesn't exist [19:22:02] this is _now_ fixed, there are three case [19:22:09] let me explain pls [19:22:22] case i) id == id(current user) [19:22:24] ==> ok [19:22:37] case ii) id = id of a different user [19:22:48] case iii) id = non existing user [19:22:55] indeed [19:23:03] Currently, all cases are correctly treated [19:23:08] pls. check the url above [19:23:13] yes. I saw that [19:23:19] but we can now: [19:23:23] do this: [19:23:36] for case ii) and iii) show the same page [19:23:37] saying [19:23:49] "This is not your id page" [19:23:55] that's all [19:24:12] I fix that if you agree [19:24:17] it's a pleasure for me [19:24:18] Isn't it a little better to tell them a user doesn't exist in case iii? [19:24:25] This is done !!! [19:24:31] It IS in [19:24:42] I'm not sure what the proposed change is, then? [19:24:54] https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/extensions/OpenID.git;a=blob;f=SpecialOpenIDIdentifier.body.php;h=d8270c4c4e63602fc3a00124feff3aa923ea1498;hb=HEAD#l63 [19:25:05] not say in case ii) [19:25:14] that this is the id of another user [19:25:20] but simply say: [19:25:26] This is not your id [19:25:30] yeah. that's fine [19:25:38] (you proposed that yesterday night) [19:25:43] ! [19:25:43] There are multiple keys, refine your input: !log, $realm, $site, *, :), access, account, account-questions, accountreq, addresses, addshore, afk, alert, amend, ask, b, bang, bastion, beta, blehlogging, blueprint-dns, bot, botrestart, bots, bots-bsql, botsdocs, broken, bug, bz, cmds, console, cookies, coren, credentials, cs, damianz, damianz's-reset, db, del, demon, deployment-beta-docs-1, deployment-prep, docs, documentation, domain, epad, etherpad, extension, -f, forwarding, gerrit, gerritsearch, gerrit-wm, ghsh, git, git-branches, git-puppet, gitweb, google, gridbots, group, help, hexmode, home, htmllogs, hyperon, icinga, info, initial-login, instance, instance-json, instancelist, instanceproject, keys, labs, labsconf, labsconsole, labsconsole.wiki, labs-home-wm, labs-morebots, labs-nagios-wm, labs-project, labswiki, leslie's-reset, link, linux, load, load-all, logs, mac, magic, mail, manage-projects, meh, mobile-cache, monitor, morebots, msys, msys-git, nagios.wmflabs.org, nagios-fix, newgrp, new-labsuser, new-ldapuser, nova-resource, op_on_duty, openstack-manager, origin/test, os-change, osm-bug, pageant, password, pastebin, pathconflict, petan, ping, pl, pong, port-forwarding, project-access, project-discuss, projects, puppet, puppetmaster::self, puppetmasterself, puppet-variables, putty, pxe, python, q1, queue, quilt, report, requests, resource, revision, rights, rt, Ryan, ryanland, sal, SAL, say, search, security, security-groups, sexytime, single-node-mediawiki, socks-proxy, ssh, sshkey, start, stucked, sudo, sudo-policies, sudo-policy, svn, terminology, test, test2, Thehelpfulone, tl, tooldocs, trout, tunnel, unicorn, whatIwant, whitespace, wiki, wikitech, wikiversity-sandbox, windows, wl, wm-bot, [19:25:48] uih [19:26:01] "The URL provided does not match your identity" [19:26:03] or something like that [19:26:04] Yes [19:26:14] I will fix that. Let me some time [19:26:19] * Ryan_Lane nods [19:26:22] I have a "lecker" beer here [19:26:25] lecker = yummy [19:26:47] Something different. [19:27:13] I added some of the open bugs to "block" the one other bugzilla, I guess, you have noticed [19:27:23] don't feel pushed [19:27:28] by that [19:28:17] "the one other bugzilla" is https://bugzilla.wikimedia.org/show_bug.cgi?id=9604 <-- tracking bug, ok [19:28:19] ??? [19:29:05] If you agree, I can rename or add that " (tracking bug)" [19:29:53] I did that. Not waiting for Ryan [19:30:41] (I have nothing else, and I am on standby. Bye) [19:44:35] I leave it as it is. Otherwise, it will break. If we stop to add the invisible X-XRDS location urls, it will break the whole system [19:44:40] Ryan_Lane: ^ [19:45:14] I would have to render the X-XRDS links, but show a text "this is not your open id" [19:45:37] this is possible, but really, I think this not needed and, ugly. [19:45:53] It woudl be nice if you test the current code on the openid-wiki instance [19:46:00] then you see, what I mean [19:47:00] Ryan_Lane: try that one http://openid-wiki.instance-proxy.wmflabs.org/wiki/Special:OpenIDIdentifier/1 [19:47:03] and http://openid-wiki.instance-proxy.wmflabs.org/wiki/Special:OpenIDIdentifier/0 [19:47:07] and http://openid-wiki.instance-proxy.wmflabs.org/wiki/Special:OpenIDIdentifier/1000 [19:47:17] and your userid [19:48:04] and http://openid-wiki.instance-proxy.wmflabs.org/wiki/Special:OpenIDIdentifier [19:48:19] I think, it makes sense to leave it as it is. [20:21:40] andrewbogott: Reply't [20:21:59] thanks [20:25:20] andrewbogott: And I just added a Q of my own. /Can/ we assign 'service group' management to a role that is not 'projectadmin'? [20:25:58] If so, I would do that and s/project admin/users with that role/ through my entire reply. :-) [20:26:19] Coren, aren't you writing a script to create the service users anyway? So if it detects the presence of a group it can just create the user [20:26:59] andrewbogott: I'd very much rather not have local users. I /can/ do it, but it's ugly as sin and I'm pretty sure Ryan_Lane really wanted the users to be in LDAP. [20:27:16] Ah, ok, makes sense. [20:27:24] I thought that all of the user creation was going to be mediated by a script anyway. [20:28:05] That's my current ugly stopgap. Creating local users in a for loop of ssh to the boxen is... not my favorite thing. :-) [20:28:23] The script will create homes, etc. [20:28:44] (Which is done exactly once, since it's on a shared filesystem) [20:34:07] Oh, oops, my question about 'how' was not about privs but about how things are represented in ldap. [20:35:45] lemme respond to the emails :) [20:45:12] reply'd [20:45:38] mailman is slow :( [20:45:48] Coren: the script doesn't need to create homes [20:45:52] pam_mkhomedir will do that [20:47:46] Oh, poop. That's an implementation detail that needed to be said; tools have their homes in /data/project without the local- prefix, and have different permissions and skeletons than "normal" users. I'd really rather they not be created by pam [20:48:32] They are g+s,o=rx for one, which is not "normal home" perms [20:49:06] just make them in the script and pam_mkhomedir won't touch them heh [20:57:21] ah [20:57:22] right [20:57:30] Ryan_Lane: Sorry, my email must not've been clear on my actual question. What I don't understand is: How, in ldap, will group membership be represented? [20:57:39] via groupofnames [20:57:48] with DNs for users [20:57:53] just like project membership [20:57:59] or project groups [20:58:44] ok. [20:59:02] I maybe understand how to do that; will look at the existing code. [20:59:17] we should probably refactor some [20:59:36] adding/removing group code should go into LdapAuthentication [20:59:41] and the other classes should call it [21:11:57] Ryan_Lane: Oh, noes, I really think the service account's primary group should be a global one that marks them as such. [21:12:00] Coren: I don't understand why the service user's primary gid shouldn't be its service group? [21:12:19] Ryan_Lane: Well, on a purely practical level, SGE only looks at the primary gid. :-) [21:12:31] meaning...? [21:12:46] Ryan_Lane: That's how I separate humans from tools. :-) [21:13:20] it's less secure to use a group all tools are members of [21:13:43] Ryan_Lane: ... to say "it's a tool"? [21:14:11] files written by the tool user will have "service" by default, not their service-group [21:14:29] assuming the umask is 002, that's a problem [21:14:53] Ryan_Lane: Ah; not really, the tools' home are sgid for that very reason so that /every/ write in it is reachable to the maintainers. [21:15:12] Ryan_Lane: Besides, that's no different than humans being gid 500. [21:15:18] * Ryan_Lane nods [21:15:28] I'm not a huge fan of everyone having the same primary gid right now, either [21:15:33] Ah. [21:15:51] I'm old school. It's SOP to have a 'is a user', 'is a service', 'is a foo' primary group. [21:15:52] :-) [21:16:04] that's what secondary groups are for [21:16:15] s/old school/old/ [21:16:17] I see those as roles, not nature. :-) [21:16:18] :D [21:16:28] I see secondary groups as roles [21:16:32] you can only have a single primary group [21:16:51] and changing it has far reaching consequences [21:17:01] Right. So that should be indicative of what kind of account it is rather than one of the (possibly many) roles the account may hold. [21:17:02] Coren, what about files created in /tmp ? [21:18:10] Platonides: Same as any file created in /tmp -> should not have special privileges granted to group unless you /know/ you did a setegid() first. [21:18:27] if umask is 002.... [21:18:46] which it needs to be [21:19:28] this is the strength of user groups [21:19:48] Ryan_Lane: You're right, this is why the primary group should be an invariant (like, "it's a human", "it's a service account") and not a role. [21:20:04] it should be the same as the user [21:20:15] specifically for this reason [21:20:26] no need to worry about group permissions [21:20:40] Ryan_Lane: Group ownership of files should /never/ be left to defaults. Either to setegid(), or use sgid on directories you intend to use, or you change the creation mask. Anything else is a bug waiting to happen. [21:20:45] hahaha [21:20:47] good luck on that [21:21:03] I bank on people's ignorance [21:21:35] s/ignorace/stupidity/ [21:21:45] Ryan_Lane: Anyone who doesn't take those basic security precautions will have code full of MUCH bigger holes anyways. You're plugging a single hole in a strainer. :-) [21:22:05] always assuming people will do the easier thing and not the right thing and changing your security to accommodate that is a good idea [21:22:16] Hm. [21:22:16] that's not a basic security precaution, though [21:22:25] people have to be taught that [21:22:31] most people are used to user-groups [21:22:39] and people *suck* at file permissions [21:22:51] most people don't even know what sgid on directories does [21:22:54] What, not writing temporary files in a public directory without making at least sure that it doesn't have group write isn't basic? :-P [21:23:07] why can't it have group write? [21:23:24] if you aren't adding every user into the same group it's not a problem [21:23:35] Because if you allow a group writing it, you should at /least/ know what group you're granting it to. [21:23:37] in fact, it's a good idea [21:23:58] Of course it's a problem, unless you actually stat() the directory before creating the file then guard against a race condition. [21:24:10] well, people should be using mktmpdir [21:24:28] it's unsafe to use a tmp dir without it [21:24:41] Ryan_Lane, I don't seem to have such tool... [21:24:46] in which pkg is it? [21:25:02] If you allow group write on a file you put in a public directory, you never actually know what group will end up with write access to it since you can't guard against the directory being sgid unless it's yours. [21:25:07] (you could change your umask, create the folder, then restore it...) [21:25:13] Platonides: it's mktemp -d [21:25:25] ah [21:25:27] Coren: which is the purpose of mktemp -d [21:25:46] it's unsafe to write into tmp without it [21:25:49] Ryan_Lane: In which case, you're not writing in a public directory anymore. :-) [21:26:02] you are still using tmp [21:26:13] but a private directory in it [21:26:24] but, directory permissions still apply there [21:26:53] Incidentally, mktmpdir protects only against some attacks. [21:27:07] yes, but that's a different argument altogether ;) [21:27:25] we can't assume that applications are going to properly set umask [21:27:29] No, since someone could sill make you end up writing your files in a directory sgid to them. [21:27:38] Coren: how? [21:28:44] anyway, what does a shared group really buy us? [21:28:46] By guessing the new dir name and making a symlink to a directory that isn't sticky in its place. [21:28:51] that makes it worth the security risk [21:29:09] mktemp -d creates the directory, then reports back [21:29:17] then you use the directory that's reported back [21:29:25] it's safe in that regard [21:30:00] people can symlink all they want. it's not going to help for that ;) [21:30:16] They may have fixed the dereference race condition. Anyways. [21:31:13] The common group simplifies management, IMO, and classifies accounts. I'm not deadset against it, but I think the new one-role-per-user fad is misguided. :-) [21:31:43] the accounts are already classified. they start with local- [21:32:05] I'm not sure how it simplified management. have any examples? [21:32:09] Making groups with a membership of one, IMO, is an attempt to circumvent a human problem with a technological hack -- those /never/ end up well. :-0 [21:32:14] *simplifies [21:32:55] it's actually a fairly effective way of handling an old problem of shared default groups :) [21:32:56] It's not as relevant as it once was; but there are still tools that cannot cope with group lists, and tools that have a limit on the number of extra groups. [21:33:10] * Coren chuckles. [21:33:12] yeah, there's definitely still a limit on extra groups [21:33:20] I suppose, if you see shared default groups as a problem. [21:33:25] (Which I do not) [21:33:47] you assume everyone knows well enough not to screw themselves :) [21:33:53] or can even be taught [21:34:20] I'm of the school of thought that we should protect people from screwing themselves, at our expense :) [21:34:25] Ow. I didn't think anyone could have a worse default opinion of users than an old BOFH like me. :-) [21:35:17] you wouldn't believe how many people I've had to tell about sgid directories :D [21:35:44] I'm of the school of thought that protecting people from themselves never actually works; they'll just find another way to screw themselves but will have lost the opportunity to learn not to. [21:35:56] screw it. let's use posix acls for everything [21:36:10] Coren: ;) [21:36:13] If you remove all the "small" problems they can encounter, all that's left to them to learn is the big fuckups. :-) [21:36:54] well, this isn't necessarily a small problem [21:36:57] Heh. I don't mind posix ACL, so long as I am allowed to point at you when people go WTF? How do I ACL? :-) [21:37:16] people are going to end up writing their bot passwords in an insecure way [21:37:31] if we're telling people that their passwords are protected, that's an issue [21:37:38] Ryan_Lane: They still will have o+r anyways; groups aren't going to help that. [21:37:41] Lets all use selinux and be happy [21:38:09] Coren: why would the home directory be o+rx? [21:38:31] well, I see your point [21:38:37] Ryan_Lane: In more practical terms, however, I have noted at least twice as many users doing 777 in unique group setups. [21:39:17] I don't see that being a major problem in this situation [21:40:42] It's still an issue. You want to give users at least a minimal understanding of why permission matters, and a disclaimer that they'll shoot themselves if they are not careful. Unique groups don't really help, because it gives a false sense of security about permissions that will just bite them harder. [21:41:18] the people that understand permissions won't have an issue with it, and it protects them against applications [21:42:22] their applications aren't going to know to write files and directories with a specific group [21:42:48] I guess they could use newgrp before running the app, but I doubt people will know to do that [21:43:15] also, using newgrp sucks [21:44:57] Heh. [21:44:59] It does. [21:45:15] But I would recommend against using /tmp anyways since it's instance-local [21:45:30] * Ryan_Lane nods [21:45:31] And the grid very much doesn't guarantee you'll stay on the same instance. [21:45:52] I'd hope tmp files are only needed for while something is running and never again :) [21:46:05] of course, I know better [21:47:04] * Ryan_Lane has little faith in humanity [21:50:00] Coren /tmp is fine as well people are aware it's instance local [21:50:21] most of sane processes will drop all tmp files after they finish [21:51:31] Damianz LOLOOL [21:51:36] selinux he say :D [21:51:46] <3 selinux... so powerful [21:51:49] hehe [21:51:49] Ryan_Lane: And, again, if anyone puts anything breakable in /tmp without taking care of permissions they are in trouble anyways and no group will save them. :-) [21:51:58] I though whole thing is deprecated for ages [21:52:07] petan: selinux? Why should it be? [21:52:11] or at least not actively developed [21:52:25] most of distribution maintainers are stepping away from it [21:52:33] including canonical etc [21:53:11] hahaha [21:53:14] Ryan_Lane: Not worth debating further anyways; I can cope with tools being in strange primary groups. It's just... eeew. [21:53:26] petan: it's very heavily developed by red hat [21:53:34] it's superior to apparmor in lots of ways [21:53:37] selinux is widly used in RHEL [21:53:46] mhm... [21:53:58] petan: And, honestly, I use selinux on my own net exposed servers as well (though not RH's policies) [21:53:59] and it has hundreds/thousands of policies written for it [21:53:59] I don't see a reason why apparmor exist then [21:54:03] and apparmor has almost none [21:54:30] Apparmor is simpler but also suuucks [21:54:32] what's the point of it then? why ubuntu doesn't use selinux over apparmor by default? [21:54:52] petan: apparmor is kinda sucky; it doesn't have the simplicity for anything more flexible than a simple desktop with trivial use. [21:54:56] because they went with apparmor [21:55:05] Ryan_Lane but why [21:55:08] simplicity <-> flexibility [21:55:08] and are "invested" in it [21:55:09] also what is license [21:55:12] of selinux [21:55:21] petan: it's a kernel feature [21:55:30] so, gpl2, I'd assume [21:55:39] petan: Maybe because they had nobody who groked selinux at the time? [21:55:52] Ryan_Lane: IIRC, the actual selinux code is PD-US [21:56:01] cuz, you know, NSA. [21:56:02] remember selinux was contributed by the nsa and be happy with it for MLS [21:56:04] ah. right [21:56:49] Coren: that's sketchy from a licensing pov :) [21:57:13] Ryan_Lane: The current version is probably consumed of GPL by now as aggregate. [21:57:18] well it always looked to me that canonical invested into stuff that has future, so for some reason they probably believe apparmor has better future [21:57:21] than selinux [21:57:23] who knows [21:57:26] I never got a straight answer about my open source contributions when I was working for the government [21:57:38] canonical take random shit like unity and throw it on people and hope it sticks [21:57:46] heh [21:57:51] Ryan_Lane: LOL [21:58:06] petan: Last I checked, no distro team had clairvoyance or infallibility. :-) [21:58:07] Just contribute under your own name and avoid all legal issues with company and releases etc [21:58:24] Damianz: that doesn't really work when you are doing the work on behalf of the federal government [21:58:28] Coren canonical is a huge company rather than distro team :P [21:58:31] IMHO [21:58:35] don't know them much though [21:58:40] petan: Same level of clairvoyance. :-) [21:58:43] but I don't like ubuntu anyway [21:58:47] "They'll never know" [21:59:13] it's how linux would look if microsoft made own distribution [21:59:16] it would be ubunut [21:59:20] * tu [21:59:23] petan: IMO, the ubuntu people do good work but sometimes take seriously boneheaded decision as to what are the right tools or default tools for some things. :-) [21:59:48] Coren I hate the philosophy... [21:59:49] I like what ubuntu is trying to do... not totally what they are doing. [21:59:55] Ryan_Lane: re Govt & open source/copyright: because the Feds want to reserve the right to enforce their copyrights in other jurisdictions. Its PD here in the US, but not anywhere else automatically. Which is why the wouldn't use CC0, from what a little birdy told me while I worked at CC :) [21:59:58] Things like launchpad or w/e it's called just suck. [21:59:58] petan: http://en.wikipedia.org/wiki/Microsoft_vs._Lindows [22:00:05] (Although, to be fair, anyone who thinks Gnome has an edge on KDE obviously doesn't actually read the code) [22:00:15] ubuntu is preventing people from being able to change stuff just to avoid potential troubles with stupid people breaking their system [22:00:40] greg-g: hm. what about when what you are working on is derivative of gpl2 code, or links against it? [22:00:45] Coren I am using gnome since it was introduced and I always liked it more than KDE :P [22:00:53] maybe it's just how it looks [22:01:02] Ryan_Lane: well, that is another matter, you have to follow the license or not use it, of course. [22:01:04] petan: "Preventing"? WTH are you talking about? I use Ubuntu exclusively, and I'm about as much of a "poweruser that leaves no default untouched" as anyone could get. [22:01:06] first graphical env I had was enlightment [22:01:10] or something like that :D [22:01:20] greg-g: right. that's what I couldn't get a straight answer about :) [22:01:25] petan: Preference of looks is a good reason to chose it for oneself. [22:01:31] Coren I mean the system is too restrictive, lot of options are hiden from users [22:01:34] Ryan_Lane: but yeah, legal weird area, since "if there's no copyright, then how is it GPLwhatever?" ;) [22:01:41] indeed [22:01:43] Ryan_Lane: anywho.... [22:01:46] Coren you can of course change them, but it's not as easy as doing it in debian for example [22:01:54] and if it's gpl, then it obviously can't be public domain :) [22:02:04] petan: I've never met something I couldn't change with Ubuntu. [22:02:17] Coren of course I never said you can't change it [22:02:17] NASA released openstack nova apache2 licensed [22:02:18] Coren I say it's harder [22:02:20] petan: Coren: see "Has the GNOME community gone crazy?"-talk at FOSDEM :) https://www.irill.org/videos/fosdem-2013/main-tracks/Has_the_GNOME_community_gone_crazy_ [22:02:25] petan: Example? [22:02:37] the government obviously doesn't follow their own guidelines :) [22:02:43] Ryan_Lane: yeah, good point..... [22:03:12] it's all confusing to me. that's why I just released code and said "fuck it" :D [22:03:28] if they cared, they would have told me to stop [22:04:06] Coren: have you dealt with libvirt authentication before? [22:04:35] Coren: eh, enabling suspending [22:04:38] I was using x509 previously, but it was kind of a pain in the ass [22:05:05] Coren basically enabling anything is annoying, the configuration tools are missing for purpose [22:05:10] Coren compiz-config [22:05:11] etc [22:05:16] Ryan_Lane: Not since 0.9; so I'm not sure how much of what I know is still relevant. [22:05:27] I wonder if I can use x509 authentication using the same cert for all clients [22:05:40] Coren you need to download all that stuff and override lot of stuff to be able to get somewhere [22:05:47] petan: Oh! You use Gnome! They're all there if you install kubuntu-complete. :-) [22:06:16] Coren and you know what suck most [22:06:18] Coren installer [22:06:23] well, I guess I'll try this in eqiad [22:06:33] Coren I hate how I can't setup lvm from installer, I hate how it's all graphical shit [22:07:01] Coren how you can't even find terminal version of installer easily (I know it exist but no idea how to get in that) [22:07:39] Coren that installer offers almost no options to customize the installation vs debian installer which offers milion of options [22:07:46] Coren: we need to get you shell in production eventually [22:08:02] Ryan_Lane I want shell in prod too XD I want to break teh things [22:08:16] heh [22:08:39] that's what puppet gerrit changes are for ;) [22:09:15] but I can't break stuff there everytime when I replace random lines with "rm -rf /" it get rejected :( [22:09:48] ;) [22:11:45] Ryan_Lane: Yes! My master plan is coming to frui^U I mean, sure, eventually. [22:11:47] btw Coren I also heard ubuntu dropped vi / vim as default editor. they don't even ship it in default installation. I can harder call their product unix anymore... bah [22:12:08] sssh, petan, do /nick Coren at an appropiate time and then ask Ryan_Lane to give "you" shell [22:12:26] these kids and their nano... [22:12:45] petan: sudo aptitude install vim-perl [22:12:57] Coren why vim-perl :o [22:13:33] Coren of course I can install and change everything so that it looks more like debian... or I could just install debian [22:13:37] Emacs have an editor in their lisp shell; I like perl in my editor. :-) [22:14:46] Doh. [22:14:50] I meant vim-nox [22:14:58] ah [22:15:07] Which is why I was confused by your question about perl and vim. :-) [22:15:07] Coren I was wondering why should I install perl syntax to vim :P [22:15:29] Because it's nice to have syntax highlighting? [22:15:35] I don't use perl [22:15:36] :P [22:15:44] I use it [22:15:48] petan: And you dare call yourself a sysadmin? :-P [22:15:54] but I don't write perl programs [22:16:09] hm. I guess I could create a virt*.pmtpa.wmnet cert [22:16:17] Coren I use bourne shell, which was first here :P [22:16:19] I need some actual R&R tonight. I shall now bail. [22:16:20] and a virt*.eqiad.wmnet cert [22:16:21] * Coren waves. [22:16:22] perl is not everywhere [22:16:25] Coren: see ya [22:16:27] /bin/sh is [22:16:30] :P [22:16:35] R&R? [22:16:45] <^demon> rest & relaxation [22:16:46] petan: for all intents and purposes perl and python exist on all linux systems :) [22:16:52] oh [22:16:57] Ryan_Lane but not on all UNIX systems [22:16:57] I thought perhaps he meant K&R xD [22:17:10] hp-ux doesn't ship that by default [22:17:11] who uses unix anymore? [22:17:24] Ryan_Lane like all large corporations? :D [22:17:25] <^demon> Local governments. [22:17:32] <^demon> Banks. [22:17:34] nobody, everyone is on iOS now [22:17:35] yes [22:17:37] (oh wait!) [22:17:38] LOL [22:17:49] actually no, everyone is on Android now [22:17:51] (oh wait!) [22:18:01] i went once into compiling gcc because the installed gcc had a bug that prevented installing perl [22:18:16] when I just wanted openssl but perl was needed for that [22:18:17] Platonides: no bootstrapping? pffft [22:18:24] boxes I am working on have no pythong [22:18:28] they don't even have bash [22:18:33] only /bin/sh XD [22:18:46] and /bin/ed [22:18:46] as text editor [22:18:46] Is there a Redis intended for labs? [22:18:46] :) [22:18:47] I hear pythongs are not secure at all [22:18:58] okay, that's second bad joke for the day [22:19:02] Also, where would I check the list of puppet packages meant for labs? [22:19:04] * YuvarajPandianT goes away [22:19:24] YuvarajPandianT, it was an arm NAS [22:19:27] YuvarajPandianT that is not the real problem of pythongs [22:19:32] superm401: when you say labs, what do you mean? [22:19:33] beta? [22:19:34] <^demon> Ryan_Lane: As of like 2008-09, $localGovt still used AIX for some things. I assume that probably hasn't changed in the last 4 years. [22:19:35] they eat all memory they can and all cpu [22:19:52] ^demon: I was kidding :) [22:19:56] Platonides: wah. your ARM NAS shipped with a gcc? [22:20:08] Ryan_Lane, Wikimedia Labs. I want to use it for http://toro.wmflabs.org/ and http://piramido.wmflabs.org/ [22:20:16] <^demon> Ryan_Lane: My sarcasm meter must be off. [22:20:22] It could be on the same node as the MW server (simpler) or a different one. [22:20:35] superm401: you guys have root on those systems [22:20:55] it's ubunty [22:20:57] *ubuntu [22:21:02] Ryan_Lane, I know. I'm trying to Do The Right Thing and use puppet if possible. [22:21:12] use the redis puppet module, then [22:21:38] YuvarajPandianT, a) it wasn't mine b) it was available as a package [22:21:46] (luckily) [22:21:47] :) [22:21:50] indeed. [22:21:55] and puppetize other missing things [22:21:55] bootstrapping gccwouldn't be fun, I guess [22:21:57] <^demon> They decided on spring hackathon dates for gerrit :) [22:22:02] it isn't [22:22:09] you start needing one library after another [22:22:42] <^demon> I've heard rumblings of a cool 2.7 feature. I hope people end up working on it. [22:22:46] <^demon> (Won't be there to know :() [22:23:07] night [22:23:24] Ryan_Lane, are there docs on how to use a puppet feature not listed on the configure screen in Labs? [22:23:38] Also, how much do you expect I would have to puppetize myself? [22:23:45] For Redis I mean. [22:26:24] superm401: yes [22:26:33] one sec [22:27:05] Ryan_Lane, thank you. I know I'm asking basic questions. I figured this would be an opportunity to learn a little puppet. [22:27:05] superm401: https://wikitech.wikimedia.org/wiki/Help:Self-hosted_puppetmaster [22:27:40] see: How do I get my puppet classes to display in labsconsole ? [23:48:10] Ryan_Lane, thank you for your help. I got it showing up in configure. I have to run, but I'll try to actually install it later. [23:48:20] I used the "redis" class.