Dzahn has uploaded a new change for review.
https://gerrit.wikimedia.org/r/232282
Change subject: admin: add group 'mw-log-readers'
......................................................................
admin: add group 'mw-log-readers'
Add a group for users who can login on fluorine and read Mediawiki
log files (/a/mw-log). These logs are world-readable so no sudo
rules are needed, just regular shell login.
Many but not all logs here are available in logstash and some users
need the additional logs on fluorine, such as api.log.
There is an existing group to get access to fluorine but that is
the "restricted" group which isn't as restricted as it sounds.
It additionally has sudo ALL as Apache and other things that are all
not needed for the common "I just need to read the logs" use case.
Bug:T108696
Change-Id: I125fcbccab6e5e583dabfef6b75513513db08963
---
M modules/admin/data/data.yaml
1 file changed, 4 insertions(+), 1 deletion(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/82/232282/1
diff --git a/modules/admin/data/data.yaml b/modules/admin/data/data.yaml
index a9273f6..a8eae3a 100644
--- a/modules/admin/data/data.yaml
+++ b/modules/admin/data/data.yaml
@@ -360,7 +360,10 @@
members: [bsitzmann, dbrant]
privileges: ['ALL = NOPASSWD: /usr/sbin/service mobileapps *',
'ALL = (mobileapps) NOPASSWD: ALL']
-
+ mw-log-readers:
+ gid: 760
+ description: users who can login on fluorine and read mediawiki logs
+ members: []
users:
rush:
ensure: present
--
To view, visit https://gerrit.wikimedia.org/r/232282
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I125fcbccab6e5e583dabfef6b75513513db08963
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Dzahn <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
