- Heroes

[heroes] Status widehat.opensuse.org aka rsync.opensuse.org
by Lars Vogdt 06 Mar '17

06 Mar '17

Hi widehat Admins You might know that we lost the dark fiber to widehat.o.o when the SUSE office got the new 1Gb line. So there was a small problem with the push of content from pontifex (aka stage.o.o) and the OBS to the machine, as they used the line that is not connected any longer. I changed the configuration on widehat now to: * use 62.146.92.203 as new "internal" IP * limit external access to rsync and http only * ssh and nrpe only reachable from NUE and PRG offices Important changes: * I reworked the rsync modules a bit (unifying user/group, listen, compress and logging options) and splitted between: ** 62.146.92.202 => external modules ** 62.146.92.203 => internal modules (push) * ifcfg-eth0 contains now also the public IPv6 address 2a01:138:a004:0:230:48ff:fe80:9a32/64 - I hope this will avoid the problem of "xinetd not listening on IPv6" in the future. I added a default route entry via fe80::2d0:3ff:fed0:8400 (as this is pushed atm) - but did not test the setup yet. => waiting for reboot * /etc/sysctl.d/ contains tuning.conf and widehat.conf containing some security and tuning options for the kernel Please check the changes and ping me back if this should go into some GIT or similar repository, as it seems to me like this got lost somehow. with kind regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

1 0

[heroes] Heroes meeting reminder
by Christian Boltz 05 Mar '17

05 Mar '17

Hello, just as a reminder: we'll have a Heroes meeting tomorrow (sunday, 2017-03-05) at 18:00 UTC. You can find and edit the planned topics on https://progress.opensuse.org/issues/17272 I just noticed that the ticket says #opensuse-project, but we always used #opensuse-admin. Lars, is this an intentional change or a bug in the ticket? ;-) Regards, Christian Boltz -- > Years ago, the installation of some packages sent emails to root [...] > This is not done any more. Why? :-? Because you didn't reply to them, the installation process then decided that it was a waste of time sending you e-mails and so......stopped sending them to you. [> Carlos E. R. and Basil Chupin in opensuse-factory] -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

2 1

[heroes] infra/salt pillar improvement
by Niels Abspoel 05 Mar '17

05 Mar '17

Hello to all, First of all let me introduce myself, my name is Niels Abspoel. I have been asked to join the infra team by Theo. I have worked on the openSUSE salt package before the systemsmanagement team took over. In the meantime I have kept myself busy with the salt-formulas on github. I work for a company named Webscale B.V. as a systems engineer and configuration management expert. Now that is out of the way, Why am I mailing: I think the infra/salt pillar setup on gitlab.opensuse.org can benefit from pillar stack configuration: https://docs.saltstack.com/en/latest/ref/pillar/all/salt.pillar.stack.html For more information on a real world example: https://www.youtube.com/watch?v=F3K706JJ2EI -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

3 10

[heroes] naming pattern
by Theo Chatzimichos 03 Mar '17

03 Mar '17

Hello, I would like to start a discussion regarding the naming pattern of our VMs. Right now there is a total mess and we need to be consistent. So here is what I propose, after a discussion I already had in a SUSE-IT's team meeting. Please be aware that NONE of the things I describe below have actually been implemented yet, so everything is up for discussion. I would like to start implementing them soon though, so I'll give the topic a deadline of three weeks (until the next team meeting, 5th of March). FQDN form proposal: $unique_ID.$location.$purpose.opensuse.org ### unique_ID This is a unique name for every machine. When one name is used, it can NEVER be reused. Thus, we will need to list them somewhere (at the progress opensuse-admin-wiki for example) (both the current and the deprecated ones) Proposals for the unique ID: 1) pattern like vmXY (X and Y being increasing numbers) 2) the cartoon names we currently have I would prefer: - cartoon names for production instances - vmXY or workerXY for CI/OBS workers - whatever for testing instances, but not cartoon names ### location This can be the country code, or city name. I would prefer the country code ### purpose This could be: - infra or prod for production instances (I prefer infra) - test for testing instances - worker for workers Examples on how our instances' FQDNs will look like: ariel.de.infra.opensuse.org donald.de.infra.opensuse.org goofy.cz.infra.opensuse.org daisy.us.infra.opensuse.org mediawiki.de.test.opensuse.org salt1.us.test.opensuse.org https://progress.opensuse.org/projects/opensuse-admin-wiki/wiki/Naming_patt… -- Theo Chatzimichos <tampakrap(a)opensuse.org> <tchatzimichos(a)suse.com> System Administrator SUSE Operations and Services Team

5 9

[heroes] Getting some action
by Nick Mantas 02 Mar '17

02 Mar '17

Greetings guys! My name is Nikos and I am currently an undergraduate student in Computer Science. I have been contributing to the project for almost 2 years now but not in the infrastructure. I really don't know which task is suitable for me but i really want to help out and learn as much as i can at the same time. I code in python and am mostly focused on the security field but i can take up any task as as long as i have a bit of guidance. You know what they say: start form the bottom :) Cheers Nikos Mantas -- Nick Mantas -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

3 2

[heroes] meeting logs and summary
by Theo Chatzimichos 02 Mar '17

02 Mar '17

Hello, I uploaded meeting logs from the last meetings, but I didn't write summaries. You can find them in the progress wiki, but maybe it would be a good idea to move them to en.opensuse.org? Our meetings are public either way, and people could benefit from reading our summaries etc. Opinions? https://progress.opensuse.org/projects/opensuse-admin-wiki/wiki/Meetings -- Theo Chatzimichos <tampakrap(a)opensuse.org> <tchatzimichos(a)suse.com> System Administrator SUSE Operations and Services Team

4 5

[heroes] FYI: privacy policy
by Theo Chatzimichos 01 Mar '17

01 Mar '17

Hello, just FYI, I plan to contact the board and the SUSE lawyers to draft together a privacy policy. I created https://progress.opensuse.org/issues/17404 to track the progress -- Theo Chatzimichos <tampakrap(a)opensuse.org> <tchatzimichos(a)suse.com> System Administrator SUSE Operations and Services Team

1 0

[heroes] security team informed about openSUSE:infrastructure
by Theo Chatzimichos 01 Mar '17

01 Mar '17

Hello, just fyi, I sent a mail to the security team to monitor openSUSE:infrastructure and its subprojects. I'll let you know about the results of the discussion -- Theo Chatzimichos <tampakrap(a)opensuse.org> <tchatzimichos(a)suse.com> System Administrator SUSE Operations and Services Team

1 1

[heroes] Dropping/Blocking Email Addresses from our mailing lists
by Lars Vogdt 01 Mar '17

01 Mar '17

Hi Today I got an emergency call from our security team: their mailing list was "spammed" from a bot (aka ticket system) - as the ticket system address (which looks it was in CC of one Email to the list) generated an Email to the list - getting an answer from mlmmj that it is not subscribed, which generated a new ticket with an automated answer, which was answered by mlmmj... (I think you got the loop) As result, I created /etc/postfix/sender_access with : $EMAIL DROP inside, did "postmap /etc/postfix/sender_access" and adapted /etc/postfix/main.cf : smtpd_recipient_restrictions = [...],check_sender_access hash:/etc/postfix/sender_access For the moment, this seems to successful break the loop, but as I'm neither the maintainer of the system nor sure that this is a good/stable solution, I hope that I simply did not break too much... Feel free to adjust/remove/whatever with the above information. Maybe someone has already a better idea...? with kind regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

3 2

[heroes] RFC: Preparing meeting at 2017-03-05, 18:00 UTC
by Lars Vogdt 24 Feb '17

24 Feb '17

Hi As I had some topics in mind for our next meeting, that I don't want to forget, I started to think about where to save them... Other teams have some information about their meetings in the wiki - so I started to setup https://en.opensuse.org/openSUSE:Heroes/Meetings ...but during that, I felt that it might be also a good idea to use our admin tool also to collect the topics and provide a schedule - so I ended up with: https://progress.opensuse.org/projects/opensuse-admin/issues?query_id=36 which is a custom query containing only issues reported in the Redmine Category "Event". My idea is to use this Category maybe also for Conferences and other stuff later. Using: https://progress.opensuse.org/projects/opensuse-admin/issues/calendar?query… should provide you with an overview of upcoming events. One problem might be that I did not find a way to include the time in the calendar, so I used the summary for it. But I hope this is a not so problematic issue for now. Instead of putting the topics in the description, I hope it's a good idea using a checklist instead (as everybody can easily add a checklist entry that will then be added in the top) - but we can also change this. What do you think? Would that work also for you - and help to organize our meeting? with kind regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

2 2