Page MenuHomePhabricator

php2shell: Phacility Cluster ops notes
Open, NormalPublic

Description

See T13704. Operational interventions required by Ubuntu 26:

$ sudo update-alternatives --config sudo
# Select sudo.ws.
$ sudo vipw -s
# Change "!" to "*" for user `dweller`.
$ sudo systemctl edit apache2.service
[Service]
InaccessiblePaths=
InaccessiblePaths=/boot
InaccessiblePaths=/root
InaccessiblePaths=-/etc/ssh
InaccessiblePaths=-/etc/apt
InaccessiblePaths=-/etc/.git
InaccessiblePaths=-/etc/.svn
$ sudo systemctl daemon-reload
$ sudo systemctl restart apache2.service

These address:

  • The default sudo is now a Rust implementation which does not support -E.
  • User accounts are getting ! in /etc/shadow when created with adduser --disabled-password, and the VCS sshd is rejecting these.
  • Apache is being forbidden from reading /etc/sudoers and related paths, which prevents it from using sudo.

Related Objects

Event Timeline

epriestley triaged this task as Normal priority.Fri, Oct 23, 3:44 PM
epriestley created this task.

Piledriver sequence is roughly:

  • Launch host.
  • Add DNS.
  • Add Almanac service definition.
  • Resize the root volume. This could be done by Piledriver, but the invocation is complicated. Modify the volume in the AWS console, then:
$ sudo growpart /dev/xvda 1
$ sudo resize2fs /dev/xvda1
  • Fix sudo per above (all tiers) and apache / dweller if applicable.
  • Deploy.