07:57 < dgilmore> mmcgrath: show time? 07:58 < mmcgrath> yep 07:58 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Who's Here? 07:58 < ivazquez> Pong. 07:58 * ianweller 07:59 < mmcgrath> so who's all here? 07:59 * dgilmore is here 07:59 * skvidal is 07:59 < G> me 07:59 * mmcgrath lets people roll in 07:59 * ricky 07:59 * nirik is off in the spectator seats. 08:00 < jcollie> hello 08:00 * f13 08:01 < mmcgrath> Allrighty, lets get started 08:01 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Open Tickets 08:01 < mmcgrath> .tiny https://fedorahosted.org/fedora-infrastructure/query?status=new&status=a... 08:01 < zodbot> mmcgrath: http://tinyurl.com/2hyyz6 08:01 < mmcgrath> .ticket 395 08:01 < zodbot> mmcgrath: #395 (Audio Streaming of Fedora Board Conference Calls) - Fedora Infrastructure - Trac - https://fedorahosted.org/projects/fedora-infrastructure/ticket/395 08:01 < mmcgrath> jcollie: any news ? 08:02 < jcollie> not really 08:02 < mmcgrath> k, next ticket 08:02 < mmcgrath> .ticket 398 08:02 < zodbot> mmcgrath: #398 (elfutils `monotone' (mtn) error) - Fedora Infrastructure - Trac - https://fedorahosted.org/projects/fedora-infrastructure/ticket/398 08:02 < mmcgrath> abadger1999: jcollie: anything there? 08:02 < jcollie> nope 08:02 < abadger1999> nope 08:02 < abadger1999> It's all roland for now. 08:02 < mmcgrath> k 08:02 < mmcgrath> .ticket 446 08:02 < zodbot> mmcgrath: #446 (Possibility to add external links on spins page) - Fedora Infrastructure - Trac - https://fedorahosted.org/projects/fedora-infrastructure/ticket/446 08:02 < mmcgrath> dgilmore: any news? 08:03 * dgilmore notes that he sucks 08:03 < mmcgrath> hah, no news then? 08:04 < mmcgrath> .ticket 547 08:04 < zodbot> mmcgrath: #547 (Koji DB Server as postgres 8.3) - Fedora Infrastructure - Trac - https://fedorahosted.org/projects/fedora-infrastructure/ticket/547 08:04 < mmcgrath> abadger1999: so we're going to package this but we didn't really get any farther then that. 08:04 < abadger1999> mmcgrath: Right. It's packaged and in the fi-repo now. 08:04 < abadger1999> F-9 versions. 08:04 < dgilmore> abadger1999: is this weekend too soon to roll out 08:05 < dgilmore> abadger1999: just thinking we can piggy back on the fsck 08:05 < abadger1999> I thought we were going to wait for the dedicated koji db server? 08:05 < jcollie> fsck is going take almost 24hrs anyway 08:05 < dgilmore> we can do that also 08:05 < abadger1999> We could deploy now... just saying that was my original plan. 08:06 < mmcgrath> yeah, lets just wait for the new server. 08:06 < mmcgrath> That way we can call an outage, try to migrate. if it fails, we can just turn db2 back on. no harm no foul 08:06 < abadger1999> <nod> Makes sense to me 08:06 < dgilmore> having done a conversion from 8.1 to 8.3 it was pretty smooth 08:06 < mmcgrath> we can do it this weekend but I won't be around much is all. 08:07 < mbonnet> the dump/restore will take a significant amount of time 08:07 * abadger1999 likes having an escape option 08:07 < dgilmore> mbonnet: which is why i suggested during the 24 hr window for the fsck 08:08 < dgilmore> but im with abadger1999 08:08 < abadger1999> <nod> Do we know how long the backup currently takes on the koji db? 08:08 < dgilmore> we do 4 a day 08:08 < dgilmore> restore will take longer i think 08:08 < mmcgrath> abadger1999: the backups don't take long, the restores take a very long time though. I'm not sure how long though. 08:08 < abadger1999> yeah. 08:09 < mmcgrath> its the indexes 08:09 < mmcgrath> abadger1999: to give you an idea, the backup is 4.1G, the database is 61G. 08:10 < abadger1999> <nod> 08:10 < mmcgrath> anywho. I'll leave that up to you tosho when you want to do it. It'd be nice to do a trial run first and import of all the production data to know what issues we'll run into. 08:11 < mmcgrath> anything else on that? If not we'll move on. 08:11 < abadger1999> k. For the real thing I say wait for the koji db server. 08:11 < abadger1999> Nope, no more. 08:11 < mmcgrath> k 08:11 < mmcgrath> next item 08:11 < G> yeah, kind of makes sense 08:11 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- The Wiki Migration 08:11 * ricky must go now :-( 08:11 < mmcgrath> So the new wiki will be in place on Friday (most of it) 08:11 < mmcgrath> ricky: later! 08:11 < ianweller> woo, my subject. :D 08:12 < ianweller> ricky: cya 08:12 < mmcgrath> we're officialy doing the switchover on Tuesday. 08:12 * dgilmore hopes he can continue to use moin syntax 08:12 < ianweller> i've had enough with moin syntax :/ 08:12 < mmcgrath> the idea is we'll do the main mass import on friday, go through, fix up, test, etc. Then just re-import the pages that have changed in moin. 08:12 * lmacken wants LaTeX syntax by default ;) 08:12 < mmcgrath> This will consume almost all of my time starting two days ago until Tuesday. 08:13 < ianweller> same here 08:13 < mmcgrath> ianweller and ricky have also been hard at work but if _any_ of you have free time we can use additional hands and eyes on this. 08:13 < mmcgrath> in testing, verifying, etc. 08:13 < mmcgrath> We're in good shape but there's a couple of hangups right now. 08:13 < mmcgrath> 1) auth 08:13 < mmcgrath> and 2) auth -> email mapping. 08:13 < mmcgrath> beyond that I don't think there's any blockers. 08:13 < jcollie> brb 08:14 < mmcgrath> A reminder, you won't be able to do regex watchlists anymore. (thats a design choice and one of the reaons Moin was so slow on page saves) 08:14 < ianweller> tomorrow after the main mass import my first priority is to fix up the WikiEditing page 08:14 < mmcgrath> s/slow/expensive/ 08:14 < mmcgrath> but you should (if we get the extension configured in time) be able to watch /wiki/Docs/* for example. 08:15 < mmcgrath> This is going to be painful for about the first month I suspect. After that we'll all be glad we switched. 08:15 < mmcgrath> Does anyone have any questions or comments about the wiki? 08:15 < mmcgrath> Anyone want to volunteer some time? 08:15 * ianweller 08:15 < mmcgrath> oh! G's also been mega helpful in this too. 08:15 < mmcgrath> as has smooge 08:15 < dgilmore> mmcgrath: what do we have as the backend/frontend setup? 08:15 < ianweller> mediawiki allows spaces in page names. 08:15 < mmcgrath> dgilmore: backend is going to be db1, frontend is going to be app[1-2] 08:16 < smooge> ? 08:16 < mmcgrath> well the append 08:16 < mmcgrath> smooge: talking about mediawiki :-P 08:16 < G> mmcgrath: I might be able to help on Tuesday, but it'll be a balancing act 08:16 < mmcgrath> to start we won't be deploying any caching abilities of mediawiki. I want to make sure to get a baseline. 08:16 < mmcgrath> G: thanks. 08:17 < mmcgrath> Anyone have anything else to discuss there? 08:17 < mmcgrath> k, next item 08:17 < smooge> ah ok. 08:17 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- 3rd party machine auth. 08:18 < mmcgrath> this is on the infrastructure list right now 08:18 < mmcgrath> nirik: ping (see topic) 08:18 < nirik> you rang? 08:18 < mmcgrath> What do y'all think? I want to be able to provide this but I need to do it in a way that won't get me fired. 08:18 * nirik doesn't want to cause any security problems... but it would be nice to have. 08:19 < nirik> I need ssh pub keys & logins I guess... no password auth. 08:19 < mmcgrath> nirik: and its a service we'd like to be able to provide. 08:19 < G> this is where something like two facter authentication would be nice 08:19 < mmcgrath> does anyone think this is a service we should not provide? 08:20 < G> oh I really do think it's something we should provide 08:20 < mmcgrath> G: indeed, I'd like to do that but right now I'm -ENOTIME unless someone else wants to pick up the job. 08:20 * ianweller is reading the list archive 08:21 < nirik> G: which 2 factors? ssh key + openid or something? 08:21 * dgilmore thinks we should provide it. 08:21 < ianweller> is the subject 'FAS and public Key auth'? 08:21 < G> if you were to do something like what the banks use (two facter auth) you have something *you* know and something you *don't* know 08:21 < dgilmore> but im biased as im one of those wanting it 08:21 < mmcgrath> Yeah, i don't think anyone is against providing it, the question now is how to do it properly. 08:21 < mmcgrath> G: yeah, and we have a couple of options there. 08:21 < G> shouldn't be too hard to implement inside fedora, you could have a pam_fas plugin or something to manage the something you don't know token 08:22 < G> login to fas, bam there is the one use token that you can use to login to the core machines w/ your public key 08:23 < nirik> well, I thought 2 factor is more: something you know + something you have... (cell/secureid fob, etc), but ok. 08:23 < wfp> To make it worth doing, doesn't 2 factor auth need something like a hardware crypto card? 08:23 < G> wfp: not really 08:23 < mmcgrath> wfp: that makes it much more secure, but there are levels of security between singlefactor and two factor w/ hardware key. 08:24 < nirik> if we have * and cell phone numbers we could use that... "call from fedora account system, do you auth this, press 1" 08:24 < G> nirik: that sounds costly :) 08:24 < ivazquez> There's PhoneFactor, but I don't think they work outside NA. 08:24 < ianweller> nirik: G: myopenid.com does that. 08:24 < G> get a SMS gateway to sponsor text messages 08:24 < ianweller> G: costly to the end user 08:24 < G> ianweller: ohhh okay 08:24 * dgilmore just wants to easily give fedora community access to a sparc box for doing mock builds 08:25 * dgilmore really doesnt care how its achieved 08:25 * nirik just wants to give fedora community acces to ppc and x86_64 boxes for mockbuilds and debugging. 08:25 < dgilmore> mmcgrath: ill bring you a sparc box to put into phx :) 08:25 < G> I agree, we should provide it for those exact reasons (didn't I mention this in my F10 wishlist? :P) 08:26 < mmcgrath> Lets think on this for another week or so and talk about it at the next meeting as well. 08:26 < nirik> I can also think of more fun stuff down the road... on demand test virtuals, access to archive of rawhide daily installs, etc. 08:28 < G> exactly, Debian offer Developer (equiv to our cvsextras) access to donated boxes for testing w/ chroots, bugfixing etc 08:28 < mmcgrath> alrighty then, beyond that I've got nothing else. 08:28 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Open Floor 08:28 < mmcgrath> Who's got something they want to discuss? 08:28 < lmacken> SELinux! 08:28 < mmcgrath> lmacken: have at it. 08:28 < lmacken> I sat down with Dan Walsh today, and we tackled the SELinux issues around bastion, app1, and proxy1. 08:28 < lmacken> .ticket 230 08:28 < zodbot> lmacken: #230 (SELinux Deployment) - Fedora Infrastructure - Trac - https://fedorahosted.org/projects/fedora-infrastructure/ticket/230 08:28 < lmacken> see the ticket for more details :) 08:28 < lmacken> progress is being made 08:29 < mmcgrath> if only we can get Dan to sit down with everyone who wants to use selinux :) 08:29 < lmacken> seriously 08:29 < mmcgrath> lmacken: how bad of shape are we in? 08:29 < lmacken> mmcgrath: well, we've got a lot of custom apps, running in a lot of custom locations. 08:29 < lmacken> which is easily fixable from an selinux standpoint 08:29 < lmacken> but puppet.. 08:29 < lmacken> that's were we need the changes 08:30 < mmcgrath> lmacken: how does selinux work with the satellite deployment tools? 08:30 < lmacken> Brett Lentz (wakko666) has been doing a great job of pushing the selinux patch and unit test to puppet upstream 08:30 < lmacken> mmcgrath: No clue whatesover 08:31 < mmcgrath> <nod> 08:31 < lmacken> dwalsh is pretty determined to get our infrastructure working 100% with SELinux by F10 08:31 < dgilmore> lmacken: builders will need alot of work 08:31 < ivazquez> What a coup that would be for SELinux. 08:31 < mmcgrath> lmacken: now with selinux and puppet are you talking about deploying selinux policies via puppet? Or actually what puppet does when deploying configs is causing selinux issues? 08:31 < lmacken> dgilmore: yes, but a lot of that is being done right now by Eric Paris, with the mock/livecd-creator stuff, right ? 08:31 < dgilmore> lmacken: not really 08:32 < dgilmore> lmacken: simmiliar but different 08:32 < lmacken> mmcgrath: deploy custom policies, booleans, and contexts with puppet.. and also making puppet smart when creating new files 08:33 < mmcgrath> solid. 08:33 < mmcgrath> well, baby steps I guess :) 08:33 < lmacken> indeed. I'm meeting with dan again next week. I'll keep that ticket up to date with our progress 08:33 < mmcgrath> solid. 08:34 < mmcgrath> lmacken: are you or dan going to hold some training sessions for the rest of our team? 08:34 < lmacken> mmcgrath: yeah, we'll make sure it's well documented and people know how to use it 08:34 < mmcgrath> solid. 08:35 < mmcgrath> anything else on selinux? 08:35 < lmacken> nada 08:35 < abadger1999> lmacken: You might want to look at app2 as well 08:35 < abadger1999> app1 is the one app server not running all of our TG apps. 08:35 < mmcgrath> solid 08:36 < mmcgrath> anyone have anything else they'd like to discuss? 08:36 < lmacken> abadger1999: yep, we'll get there :) we just wanted to hit a few different types of machines today to get a good high-level idea of what we're dealing with 08:36 < G> The voting app is near readiness 08:36 < abadger1999> Yeah, you're doing really great work on that! 08:36 < G> Hopefully I'll have something ready for testing with the masses in a day or two 08:37 < mmcgrath> G: you've got everything you need to put togther a public test of it for everyone right? 08:37 < G> I've got an RPM ready, but I spotted something wack with the URLs etc but hopefully get that fixed today 08:38 < ivazquez> Although not quite FI-specific, do we have the new planet up somewhere? 08:38 < G> mmcgrath: all I really need to create a dummy fas login, so I don't expose a real user login on pt10 and a new group in the main fas 08:38 < G> but yeah, I'll do a test deploy today on pt10 and see what happens 08:38 < mmcgrath> ivazquez: the new planet? Like what skvidal has been up to? 08:38 < mmcgrath> G: solid 08:38 < skvidal> ivazquez: call be slartibartifast! 08:39 < ivazquez> Yes. 08:39 < ianweller> hey now. slartibartfast is my computer's host name. 08:39 < ianweller> that would get confusing for me :/ 08:39 < ianweller> ;) 08:39 < skvidal> ivazquez: we still only have 78 people in the .planet files 08:39 < G> if anyone wants to, the new group is currently meant to be "elections" :P 08:39 < skvidal> and 230 in the existing planet 08:39 < dgilmore> skvidal: im sorry i suck and have not done it yet 08:39 < ivazquez> Well, it would still be nice if the 78 people could make sure that their feeds work :P 08:39 < G> skvidal: thats a third, the rest will fall in line when they suddenly disappear :) 08:40 < skvidal> ivazquez: agreed 08:40 < ivazquez> Plus it might get some others in gear when they see it happening. 08:40 < ianweller> skvidal: if you need help with pinging individual people, i'm up for it after the wiki switch ;) 08:40 < skvidal> ianm: nah 08:40 < skvidal> err ianweller nah 08:40 < iWolf> mmcgrath: re, the wiki, has any PHP hardening been done or considered? 08:40 < skvidal> ivazquez: agreed - but it's only been a week - so I didn't want piss off everyone :) 08:40 < G> abadger1999: btw, thanks 08:40 < ivazquez> A week is Forever in Fedora time. 08:41 * skvidal rolls his eyes 08:41 < ivazquez> Heh. 08:41 < ianweller> so it takes 26 forevers for each fedora release? ;) 08:41 < mmcgrath> iWolf: we have mod_security mildly deployed. Beyond that though no. Needs someone with time and experience to do it, I only have the latter at the moment. 08:41 < jcollie> ianweller: sometimes it seems like it 08:42 < abadger1999> G: For what? You've been doing all the work :-) 08:42 < iWolf> mmcgrath: understood. 08:42 < G> abadger1999: I was saying thanks for your comment :) 08:42 < ianweller> mediawiki is pretty secure (lots of testing), not so sure about the extensions though 08:42 < ianweller> the more extensions you have, the more potential holes you have. 08:43 < iWolf> mmcgrath: does one just need sysadmin-test to access the current wiki server php config? 08:43 < mmcgrath> iWolf: yes. 08:43 < mmcgrath> iWolf: We've got multiple deploys of it going, if you want your own you're encouraged to install one :) 08:43 < iWolf> mmcgrath: :) 08:43 * ianweller has one at /w-ian/ 08:44 < ianweller> that's where he's writing his IRCLog extension for the moment. 08:44 < mmcgrath> we've got like 5 or 6 wiki's I think :) 08:44 < ianweller> something like that 08:45 < mmcgrath> Ok, well talks seem to have calmed down a bit. If no one has anything else we'll close a little early this week. I'll give it 30 08:46 < G> yeah, I have nothing more 08:46 < mmcgrath> 15 08:46 < mmcgrath> 5 08:46 -!- mmcgrath changed the topic of #fedora-meeting to: Infrasturcture -- Meeting End 08:46 < mmcgrath> Thanks for coming everyone! 08:46 < G> I'll sort out the log 08:47 -!- giallu [n=giallu@81-174-9-190.dynamic.ngi.it] has joined #fedora-meeting 08:47 -!- mmcgrath changed the topic of #fedora-meeting to: Channel is used by various Fedora groups and committees for their regular meetings | Note that meetings often get logged | For questions about using Fedora please ask in #fedora | See http://fedoraproject.org/wiki/Communicate/FedoraMeetingChannel for meeting schedule