[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
[
List Home]
|
Re: [cross-project-issues-dev] The end of an era: shell access.
|
Hi Everyone,
First I'd like to apologize for the delay in responding to some of the questions I've seen regarding this change.
I chose to notify the community at large because that seemed like the right thing to do. Even though this affects 29 people directly I wanted everyone to be aware they may need to make some changes or take action.
Security is the primary motivator for this change, as local shell access provides a great jumping off point for a range of exploits. As Denis has mentioned in the past, while we trust our community to do the right thing, we must acknowledge that an operational mistake by one person can result in a large problem for the entire community.
The restricted shell does allow for rsync over SSH, at least for my basic usage. I have not tested with something like SSHFS, but if you're interested in testing it, please let me know privately.
Signing will become inaccessible, unless you are building on our infrastructure. Clearly that is not desirable, so I'm happy to work with Donat(or other interested commiiters) to find a way to allow teams using a remote build system to continue to sign once this change has happened.
Our restricted shell simply white lists certain commands, so if you find something missing the Webmaster team are certainly willing to discuss adding it to the list.
Currently SSH itself is not part of the command white list, so you will no longer be able to use build as a gateway. My preferred solution would be to migrate project vservers off of our infra and into our cloud hosting, and allowing projects 'direct' access to their hosts. As such I've filed bug 549120 to coordinate the move for Orion.
I hope this has answered most of your concerns, but if you have other questions or comments please feel free to write to Webmaster.
-Matt.
Hi Everyone,
As some of you may know we have traditionally provided a limited set of committers with shell access to
build.eclipse.org, and all other committers having restricted shells.
For the last couple of years[1][2] we've been working to reduce that number as far as possible, and the time has come to finish the process.
Effective August 28th 2019 we will be transitioning all committers that still have a regular shell to our restricted shell. You will still be able to use SFTP and SCP to interact with the downloads and archive areas(but we suggest a job on your Eclipse CI instance!)
If you have any questions or concerns please feel free to contact Webmaster.
-Matt.
[1]
https://www.eclipse.org/lists/cross-project-issues-dev/msg06625.html[2]
https://www.eclipse.org/lists/eclipse.org-committers/msg01075.html
--
