Re: aging inactive users

[Andrew Pinski <pinskia@gmail.com>]

On Fri, Apr 5, 2024 at 6:13 PM Frank Ch. Eigler via Overseers
<overseers@sourceware.org> wrote:
>
> Hi -
>
> Sourceware does not have a mechanical process for aging out hosted
> project contributors who have not logged on for a long time.  Given
> that projects haven't undertaken this sort of janitorial task, it's
> probably time that we put one in place.

I have been meaning to ask about this since LLVM started doing the
same a few months ago.
https://discourse.llvm.org/t/rfc-new-criteria-for-commit-access/76290
is when they started.

Thanks,
Andrew Pinski


>
> A brief shell script scanning ssh authentication logs in
> /var/log/secure* spanning a year indicates that only about 1/4 of our
> accumulated user base has been active during that time.
> (/sourceware/infra/bin/list-ssh-login)
>
> After gathering feedback here, I plan to send a batch of email to
> those found not to be active (via their USER@sourceware.org email
> addresses).  Then a few weeks later, if they still haven't become
> active, I plan to set them to "gid=emeritus" status, so those accounts
> can no longer log in.  (This status is easy to reverse if anyone there
> is ready to return.)
>
> For administrative/shared accounts, one needs do this analysis on a
> per-key basis.  It probably needs to be more recent, considering the
> greater privileges of these accounts, say 6 months.  There, a more
> manual process to compare ssh-keygen -l lists against the actually
> used ssh fingerprints could be used.  That way, we can age out only
> those users & keys that have not been used, but preserve others.  I'll
> work out another little script for that postprocessing and get it to
> note findings via email too.
>
> I propose to repeat this exercise every few months.
>
> Feedback & comments welcome.
>
> - FChE