fedora-infrastructure

#5930 sudo on faf01.stg.phx2.fedoraproject.org
Closed: Fixed Opened by msuchy.

Closed: Fixed
Reopen Issue

Hi,
I am trying to run
sudo rbac-playbook groups/retrace.yml -l faf01.stg.phx2.fedoraproject.org
but it fails (due some problem in our playbook). To diagnose it I wanted to log on as root. I.e. log as normal user, and run sudo bash. I should be capable of that as i am in retrace group. And I can do that in retrace.fedoraproject.org. But I am unable to do that on faf01. I really do not know.

The output of playbook looks good and is now the same as for retrace.f.o: 

TASK [sudo : setup /etc/sudoers.d/01-sysadmin-main dest=/etc/sudoers.d/01-sysadmin-main, src={{ private }}/files/sudo/sysadmin-main, group=root, mode=0600, owner=root] ***
Thursday 23 March 2017  15:10:31 +0000 (0:00:00.203)       0:00:39.271 ******** 
ok: [faf01.stg.phx2.fedoraproject.org]
TASK [sudo : setup /etc/sudoers.d/01-sysadmin-main (nopasswd) dest=/etc/sudoers.d/01-sysadmin-main, src={{ private }}/files/sudo/sysadmin-main-nopasswd, group=root, mode=0600, owner=root] ***
Thursday 23 March 2017  15:10:32 +0000 (0:00:00.268)       0:00:39.539 ******** 
skipping: [faf01.stg.phx2.fedoraproject.org]
TASK [sudo : remove old sysadmin-main file if its still around dest=/etc/sudoers.d/sysadmin-main, state=absent] ***
Thursday 23 March 2017  15:10:32 +0000 (0:00:00.070)       0:00:39.609 ******** 
ok: [faf01.stg.phx2.fedoraproject.org]
TASK [sudo : setup /etc/sudoers.d/sudoer file for client use dest=/etc/sudoers.d/{{ item | basename | replace('.', '_') }}, src={{ item }}, group=root, mode=0600, owner=root] ***
Thursday 23 March 2017  15:10:32 +0000 (0:00:00.174)       0:00:39.784 ******** 
changed: [faf01.stg.phx2.fedoraproject.org] => (item=/srv/private/ansible/files/sudo/arm-retrace-sudoers)

But still sudo fails to get me in.
I will appreciate if someone from sysadmins can fix it. Or point me how to fix it.

So, everything looks ok from a quick glance.

The 'retrace' group has sudo, you are in that group.

Note: we synced prod->stg not long ago, so your password may well be the same as your prod password. Can you try that? and/or change it at https://admin.stg.fedoraproject.org/accounts/

I am able to log into admin.stg

Yet on faf01 the same password + OTP PIN does not work. :(

You don't have any OTP tokens registered for staging.

Please see https://infrastructure.fedoraproject.org/infra/docs/docs/sysadmin-guide/sops/2-factor.rst for instructions.

Ah, I did not knew that OTP for prod and stg are separated. I created OTP token for stg and now I can get in.
Thank you for the guidance.

Metadata Update from @msuchy:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.