19:00:00 <nirik> #startmeeting Infrastructure (2011-09-15) 19:00:00 <zodbot> Meeting started Thu Sep 15 19:00:00 2011 UTC. The chair is nirik. Information about MeetBot at http://wiki.debian.org/MeetBot. 19:00:00 <zodbot> Useful Commands: #action #agreed #halp #info #idea #link #topic. 19:00:01 <nirik> #meetingname infrastructure 19:00:01 <nirik> #topic Robot Roll Call 19:00:01 <nirik> #chair smooge skvidal codeblock ricky nirik abadger1999 lmacken 19:00:01 <zodbot> The meeting name has been set to 'infrastructure' 19:00:01 <zodbot> Current chairs: abadger1999 codeblock lmacken nirik ricky skvidal smooge 19:00:22 <smooge> here 19:00:32 * abadger1999 here 19:00:33 <smooge> mostly watching a console trying to boot 19:00:43 <smooge> please ping when you need my attention 19:00:49 * athmane is here 19:01:19 <smooge> ok got it to pause. really here 19:01:53 * lmacken 19:02:28 <nirik> ok, I guess lets go ahead and dive in... 19:02:36 <nirik> #topic New folks introductions and apprentice tasks/feedback 19:02:55 <nirik> any new folks want to introduce themselves? 19:02:57 * ke4zvu3 is here too but hasn't sent the introductory email yet to join and such 19:03:04 <nirik> or any apprentice tickets or tasks we want to discuss? 19:03:11 <nirik> welcome ke4zvu3. :) 19:03:25 * CodeBlock is here, sorry. 19:04:17 <nirik> ok, I guess lets go ahead and drive on. 19:04:28 <nirik> #topic Password/Ssh-key/Cert reset flag day discussion. 19:04:47 <nirik> So, there was some discussion of this on list and some more in the most recent board meeting. 19:04:59 <nirik> Anyone have any further input on it? 19:05:39 <nirik> I would like to have docs updated and perhaps a nice wiki page to point people to before we announce anything. 19:06:38 <nirik> and we do still need to determine timing. 19:07:05 <abadger1999> If we're changing the password reqs it would need a little FAS coding too. 19:07:15 <nirik> yeah, that too. 19:07:18 <smooge> how much? 19:07:53 <abadger1999> non-invasive (modify one method) but how much depends on how complex an algorithm. 19:08:03 <abadger1999> If it's "20 chars" it's easy :-) 19:08:06 <nirik> For timing, I am thinking perhaps a month after f16 might make sense... or 2 weeks. That way people who are busy with the release can push it out until it's done and have time to do changes then. 19:08:26 <nirik> .ticket 2804 19:08:28 <zodbot> nirik: #2804 (Decide on FAS password requirements.) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/2804 19:08:31 <smooge> nirik, that sounds good. 19:08:38 <nirik> we had a more complex set in that ticket we talked about. 19:09:41 <nirik> which we could of course revisit. 19:09:50 <abadger1999> ah, but that was before the xkcd ;-) 19:09:57 <smooge> still digesting 19:10:00 <nirik> true. ;) 19:10:01 <lmacken> heh 19:10:53 <nirik> I think perhaps the next step here is to gather all these things and post a plan... 19:10:54 <smooge> I would add one line to cover that. 19:11:11 * skvidal is here 19:11:11 <smooge> if its over 20 characters only lower case and spaces is needed :) 19:11:14 <nirik> oh, there is also another issue if we want to make sure people don't reupload their old certs. ;) 19:11:25 <nirik> welcome skvidal. 19:11:25 <skvidal> nirik: what's that? 19:11:53 <nirik> well, we need to code a check in fas to save the last key and verify the new one isn't it. 19:12:16 <skvidal> nirik: OR 19:12:25 <skvidal> we could just do it as a nightly cron job 19:12:32 <skvidal> grab a copy of the pubkeys now 19:12:44 <skvidal> and compare them with ones each night 19:12:55 <skvidal> if they are same as before 'nuke the key and send an email' 19:12:59 <nirik> well, there's also the case of 'upload crap key, then reupload old key', but not sure people would go to that length. ;) 19:13:20 <skvidal> well that's why we grab their keys now 19:13:23 <skvidal> but yes 19:13:24 <skvidal> you're right 19:13:47 <nirik> also, if it's in fas it might be nice moving forward.. 19:14:24 <skvidal> true 19:14:25 <smooge> nirik, oh I am sure one or 2 would :). 19:14:33 <nirik> so, let me do this (or anyone else): collect things we need to put in place and a suggested timeline and go from there? 19:15:14 <smooge> tht sounds good 19:15:18 <skvidal> ok 19:15:25 <nirik> fas password changes, fas key reuse checking, docs to point people at about good security, way to notify everyone (mass email?), and deadline/what happens if you fail. 19:16:04 <nirik> we could also restrict the ssh key requirement to only some groups? or do we not want to do that? 19:17:11 <nirik> ie, anyone who could actually use them in fedora? but then that would leave someone who uploaded one, then gets sponsored and has an old key. 19:17:13 <abadger1999> as long as null is an okay state, I'd be more in favor of all. 19:17:30 <abadger1999> yep, for the reason you just stated. 19:18:21 <nirik> ok. will whip up a plan... 19:18:28 <nirik> #action nirik will whip up a plan/schedule. 19:18:37 <nirik> anything else on this? 19:18:44 <skvidal> nope 19:18:57 * pingou late 19:19:27 <nirik> I'm sure we will see pushback on the ssh key thing... so I think it's impotant we have good docs and announcement that explains why we want to do this. ;) 19:19:37 <nirik> hey pingou 19:19:45 <nirik> #topic Bastion outages/openvpn discussion. 19:19:59 <nirik> So, bastion03 has been hitting what looks like a nasty virtio bug. ;( 19:20:15 <nirik> I've changed it to use e1000 for it's network, so hopefully it will be stable again. 19:20:49 <nirik> if it croaks again, we should switch back to bastion02 for now. 19:21:09 <nirik> due to this issue, it's gotten me thinking about how we could better do our vpn setup... 19:21:26 <nirik> but none of the options look too great to me. 19:21:46 <smooge> yeah 19:21:47 <nirik> The best currently is to resetup heatbeat after the freeze... so at least we have failover. 19:22:44 <nirik> so, if anyone has brilliant ideas for improving the setup, please do share them with the list/etc. 19:23:30 <nirik> #info bastion03 hopefully stable now. 19:23:42 <nirik> #info will look at setting heartbeat back up after the freeze. 19:23:55 <nirik> any other comments on this?/ 19:24:17 <smooge> looking at rhel5 for this if rhel6 is not stable 19:24:30 <pingou> ie bastion02 19:24:44 <nirik> yeah, we still have bastion02(rhel5) around. 19:24:55 <nirik> but I'd really like to get us migrated to 6. ;) 19:25:29 <nirik> #topic Upcoming Tasks/Items 19:25:29 <smooge> well I mean el5 on kvm 19:25:42 <nirik> smooge: yeah, I suppose we could... as a last resort. ;) 19:25:52 <smooge> sorry my brain is feeling like someone hit it with a brick twice 19:25:54 <nirik> ok, so we are in freeze currently. 19:26:10 <nirik> So, this is a good time to work on docs and such... 19:26:36 <nirik> askbot is moving along toward production. 19:26:47 <nirik> paste is doing so as well, but not yet in stg. 19:27:01 <nirik> any other upcoming items people are working on they want to talk about? 19:28:12 <ke4zvu3> can i ask a question about paste? 19:28:34 <nirik> Oh, another after the freeze thing: I want to move some vpn hosts around... move hosts that don't need much vpn access to a subnet that is more iptables locked. 19:28:38 <nirik> ke4zvu3: sure. 19:28:39 <ke4zvu3> is the intention to take over the fpaste.org domain from Unity or would the production FQDN be paste.fedoraproject.org ? 19:29:01 <smooge> we don't own fpaste.org 19:29:06 <nirik> ke4zvu3: I think the plan was to take over the domain, but it's still unknown if the domain owner wants to move it over. 19:29:10 <smooge> and the owner has not been very communicative I believe 19:29:15 <nirik> if not, then paste.fedoraproject.org. ;) 19:29:17 <ke4zvu3> understood, thanks. 19:30:20 <nirik> Oh, we also do have all the beta tickets. I filed them yesterday. 19:30:34 <nirik> .ticket 2945 19:30:35 <zodbot> nirik: #2945 (Fedora 16 Beta - New website) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/2945 19:30:37 <nirik> .ticket 2946 19:30:38 <zodbot> nirik: #2946 (Fedora 16 Beta - verify mirror space) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/2946 19:30:41 <nirik> .ticket 2947 19:30:43 <zodbot> nirik: #2947 (Fedora 16 Beta - release day ticket) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/2947 19:30:47 <nirik> .ticket 2948 19:30:48 <zodbot> nirik: #2948 (Fedora 16 Beta - verify release permissions with rel-eng) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/2948 19:30:49 <nirik> .ticket 2949 19:30:52 <zodbot> nirik: #2949 (Fedora 16 Beta - Mirrormanager redirects for beta) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/2949 19:31:27 <smooge> nirik, ok I will take my usuals :) 19:31:29 <smooge> thanks 19:31:32 <nirik> smooge: cool. ;) 19:32:11 <nirik> #topic Open Floor 19:32:17 <nirik> Any items for open floor? 19:32:32 <smooge> ppc is a lovely architecture and I have no idea why it never took off 19:32:38 <skvidal> smooge: haha 19:32:41 <pingou> ^^ 19:32:41 <ke4zvu3> ha 19:32:43 <skvidal> smooge: LIAR LIAR 19:32:55 <pingou> skvidal: "be nice" :) 19:33:01 <nirik> smooge: but it's ultra secure... not booting and all. ;) 19:33:16 <skvidal> pingou: :) 19:33:18 <CodeBlock> :) 19:33:24 <smooge> yes.. and all you need to do to make a box not boot is take out its working drive and PUT BACK the drive 19:33:57 <smooge> I haven't had this much fun since the great days of playing with HPUX-5 19:34:14 <nirik> joy. 19:34:28 <nirik> ok, I guess lets wrap up and go back to infrastructuring. 19:34:32 <nirik> thanks for coming everyone! 19:34:39 <nirik> #endmeeting