[cfarm-users] Aging inactive cfarm users?

[Baptiste Jonglez]

On 09-04-24, David Malcolm via cfarm-users wrote:
> I was wondering if the compile farm has any policies/procedures for
> aging out long-dormant users (to minimize exposure in case of stolen
> credentials).

Good question.  We have no such policy currently.  We can of course
disable accounts, but it currently happens only when people explicitly
indicate they don't need access to the farm anymore, or in case of serious
abuse.

We have both long-term users and short-term users, so a policy would have
to account for all cases.

> For example, I've sponsored a few GSoC contributors over the years as
> cfarm users, and some haven't stayed around within FLOSS.
> 
> FWIW, a similar discussion for Sourceware can be seen here:
> https://inbox.sourceware.org/overseers/ZhQZXogZMozVjIYn@elastic.org/T/#t

It would not be straightforward to track all SSH access on the farm, both
for privacy reasons and technical reasons (the farm has very diverse
systems, and some people run jobs via cron).

Baptiste
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.tetaneutral.net/pipermail/cfarm-users/attachments/20240414/ae1599d7/attachment.sig>