Production access

For instructions on accessing public Cloud VPS and Toolforge instances, see Help:Access.

Production (sometimes called prod) is the network of servers that run the real, live Wikimedia websites. Access to production is necessary for deploying updates and other site reliability engineering work, as well as for accessing sensitive data. This page explains how to request and set up this access.

Remember: production access is extremely sensitive. With production access, it's possible to break our websites or steal private data about users' activities. If you have access, act carefully and take the server access responsibilities seriously. Immediately contact the SRE team if you have any doubts about security or if something goes wrong.

Eligibility

Production access is regulated by SRE team; they grant it only when it is strictly needed and can deny any request that that creates an unacceptable security risk.

A request that is likely to be granted needs to contain three main things:

1. A clear, ongoing need for the access. Requests based on a one-time need will not be granted. if you have a one-time need for data, request the data instead.
2. A non-disclosure agreement with the Wikimedia Foundation. If you work for the Foundation, this was probably included in your employment agreement. Otherwise, you'll have to follow the volunteer NDA process.
3. Support from a relevant Wikimedia Foundation employee. If you work for the Foundation, this should be your supervisor; otherwise, this should be the employee you will be collaborating with.

Request process

Shells!

If you've satisified the eligibility requirements above, you can make the access request by following these instructions.

Accounts

To follow these instructions, you'll need the following accounts:

• A Phabricator account. If you don't have one, see the instructions for creating an account on mediawiki.org.
• A Wikimedia developer account. If you don't have one, follow the link.

Signing the agreement

Next, read and sign the Acknowledgement of Wikimedia Server Access Responsibilities. Make sure you actually read it; this is a legal agreement and by signing it, you are committing to follow the security practices it describes.

Generating your SSH key

Since production access uses the Secure Shell protocol (SSH), you'll have to generate a new SSH keypair. Do not reuse an existing key; this presents an unacceptable security risk.

GitHub has a good help page (note that you can switch between Mac, Windows, and Linux documentation right under the title).

We recommend that you use an ED25519 key (or, alternatively, a 4096-bit RSA key). Do not use DSA keys as they are insecure and rejected by our SSH servers.

To generate an ED25519 key, run the following command in your terminal:

ssh-keygen -t ed25519

To generate an RSA key, run the following command in your terminal:

ssh-keygen -t rsa -b 4096 -o

Some systems don't support the newer -o option which saves private keys in a slightly more secure format (OpenSSH rather than PEM), but those should be fairly rare, it was introduced in 6.5

The minimum bit length for this key is -b 2048, which is currently the default length for OpenSSH. More bits won't hurt.

Remember: the key you use for production access must be different from the key you use for Cloud VPS, so do not paste it into the Openstack field under Special:Preferences on this wiki).

Filing the request

1. Create a ticket requesting access.
   1. In the title, replace "RESOURCE" and "USER" with your name and the resource you need access to. (For new user requests, make a separate ticket for each user.)
   2. Add the following information to the description:
      • Your full name
      • Your developer access username (that is, the one you use for Cloud VPS SSH, not Wikitech login. Wikitech shows this as "instance shell account name" in preferences). We will use this as your production shell username.
      • The public key from new your SSH keypair.
      • A detailed reason for your request. In particular, describe which specific servers you need access to and why. We err on the side of giving fewer permissions rather than more, so the more detailed your request, the more likely you are to get all the permissions you need.
2. Get approvals from the following people as comments to the Phabricator task. The comments should be made directly through the web interface, not via email.
   • The relevant Wikimedia Foundation employee, as explained above.
   • The project lead where your access will be granted.
3. For most requests, a three business day waiting period must be observed after the request is filed.
   • This may not be required when the request is to correct a previous request, but should be followed for escalations that include not previously approved permissions. It may not be required in some other circumstances.
4. When your request is approved, you will be asked to provide your full legal name, preferred email address for contact, and physical address to the Wikimedia Foundation Legal team (or your employee contact may forward this information on your behalf). This information will be used to customize a non-disclosure agreement, which you will be asked to read, comprehend, and electrically sign through the Foundation's contract management system. The agreement will be similar to the Volunteer NDA.
5. The Wikimedia Foundation employee that will be supervising your work will coordinate final sign off by an Executive level staff of the Wikimedia Foundation when all other criteria have been met before your access is granted.
6. Shell access and access to private data are different things. Access to data is granted to volunteers only if they have a formal collaboration with the research team.

If five business days pass without visible progress, please comment on the ticket to request an update, or directly contact the SRE on Clinic Duty that week.

Technical details

Production shell users, their keys, and their permissions are managed in modules/admin/data/data.yaml in the operations/puppet.git repository.

Setting up your access

Setting up your SSH config

The standard configuration for people not having root access is to have the ssh connection to be established on a bastion and proxy the command to the target host inside the cluster. To do this, add the following to your SSH config file (usually located at $HOME/.ssh/config):

# Configure the initial connection to the bastion host, with the one HostName closest to you
Host bast
    User your_username_here
    HostName bast1002.wikimedia.org
    IdentityFile ~/.ssh/your_production_ssh_key
    ForwardAgent no
    IdentitiesOnly yes

# Proxy all connections to internal servers through the bastion host
Host *.wmnet
    User your_username_here
    ProxyCommand ssh -W %h:%p bast
    IdentityFile ~/.ssh/your_production_ssh_key
    ForwardAgent no
    IdentitiesOnly yes

In the example above you may replace bast1002.wikimedia.org with the bastion that is physically closest to you:

• bast1003.wikimedia.org in the eqiad cluster in Virginia, United States
• bast2003.wikimedia.org in the codfw cluster in Texas, United States
• bast3006.wikimedia.org in the esams cluster in Amsterdam, The Netherlands
• bast4004.wikimedia.org in the ulsfo cluster in San Francisco, United States
• bast5003.wikimedia.org in the eqsin cluster in Singapore
• bast6002.wikimedia.org in the drmrs cluster in Marseille, France

Map of bastion hosts

eqiad

codfw

esams

ulsfo

eqsin

drmrs

Advanced: Setting up DNS

Wikimedia and WMCS currently use two non-standard TLD to manage the wikimedia name space. As these TLDs are non-standard you will not be able to look them in using standard DNS operations unless you are on the wikimedia network. however if you run your own caching server you can configure it to forward queries to the correct resolvers. you should be able to use the following configuration examples to configure your local DNS

knot-resolver

In the below config STUB is over FORWARD. this is because knot-resolver preformes dnssec validation by default and since we use fake TLD the cache would normally have an NSEC record from the root attesting that theses zones don’t exist. Using STUB disables DNSSEC (which is not currently used at the foundation)

wmcs_zones = policy.todnames({'eqiad.wmflabs'})
wmcs_ns = {'208.80.154.11', '208.80.154.135'}
production_zones = policy.todnames({'wmnet', '10.in-addr.arpa'})
production_ns = {'208.80.154.238', '208.80.153.231', '91.198.174.239'}
policy.add(policy.suffix(policy.STUB(production_ns), production_zones))
policy.add(policy.suffix(policy.STUB(wmcs_ns), wmcs_zones))

after applying the config you may need to clear the cache

root@turris:~# socat - /tmp/kresd/tty/*
cache.clear('wmnet')
cache.clear('10.in-addr.arpa')
cache.clear('eqiad.wmflabs')

Advanced: operations config

If you will be setting up new servers or doing other administration work, you can use the below advanced configuration instead. Otherwise, skip this section. If you're not sure, you almost certainly don't need this!

Known host files

To ensure the validity of the hosts you connect to, enable the StrictHostKeyChecking yes option and create a local list of known hosts. A utility script is available to generate that list and keep it up to date. Read the instructions in the script's header for help on usage. If you need any additional help, contact the script's author.

Before you can use the script, you'll need to bootstrap this setup with at least one bastion host. Disable strict host key checking, ssh to a bastion, and make sure the fingerprint matches what's listed at Help:SSH Fingerprints.

Security

See also: Help:SSH Fingerprints

Do not use SSH agent forwarding (the -A command line option). Agent forwarding does not make it possible to steal your private key itself, but it does make it possible for someone to hijack your SSH agent and thus your identity, so we do not do it. The -a option (with a lower case "a") disables agent forwarding, and is thus included in the sample configurations below.

This page used to recommend that you add the following lines to protect against an SSH bug from 2016, don't use any longer:

Host *
    UseRoaming no

However, we are now using an updated version which removed the vulnerable options, so you will get an error if your config includes the lines above. Just remove them from your config to connect.

Do not use your production cluster SSH key for any other service, including Gerrit or Cloud VPS.

Other tips

• Fundraising infrastructure config
• Greg Grossmeier's SSH config
• Managing multiple SSH agents
• Notes on configuring SSH for production shell access (for the purpose of working with the stats servers stat1002/3/4), by Zareen
• (experimental) Bash script to detect the correct bastion and auto-fix SSH config

Debugging

If your production access has been approved but you aren't able to log in, you can ask for help in the Phabricator ticket for your access request. If you got access a long time ago and it's a new problem, you can file a new ticket and tag it with #operations.

Wherever you ask for help, make sure you include your SSH configuration (but not your key itself!) and the output you get when you run your ssh command with the -v option (verbose mode).

If you are prompted for a password when attempting to SSH into production, it generally means that your client is misconfigured -- most often you are presenting the wrong public key to the server. ssh -v can help you debug this. When debugging, in order to keep things clear, it's best to attempt to connect directly to a bastion host, e.g. ssh -v bast1002.eqiad.wmnet.

See also

• Help:Access for instructions on accessing Cloud VPS and Toolforge instances
• Help:SSH Fingerprints for fingerprints of ssh bastion servers
• Proxy access to cluster for direct web access to production servers behind the firewall
• Yubikey-SSH and Yubikey4 and gpg-agent for instructions on using a YubiKey device to manage your ssh key
• Managing multiple SSH agents for help configuring separate ssh-agent instances for different security realms
• Fundraising/tech/ssh config for help configuring ssh for access to hosts in the frack environment