How to (Extra) Ban Someone: Difference between revisions

From CSCWiki
Jump to navigation Jump to search
(Be less destructive)
 
(2 intermediate revisions by one other user not shown)
Line 1: Line 1:
⚫
This is a (hopefully comprehensive) '''guide on ensuring their existing account (based on their WatIAM) is put out of action for good, and immediately'''. This guide is mainly intended for ''Syscom'' as it requires root or admin access to many CSC services.
Ahem, so in recent times, we had to ''disable/ban'' a CSC user's account for their repeated attempts to circumvent their ban in MathSoc/CSC (FR, totally no pun intended)...

⚫
This is a (hopefully comprehensive) '''guide on ensuring their existing account (based on their WATIAM) is put out of action for good, and immediately'''. This guide is mainly intended for ''Syscom'' as it requires root or admin access to many CSC services.


=== Step 1: Remove Membership ===
=== Step 1: Remove Membership ===
Through CEO's TUI (<code>ceo</code>) :
Through CEO's TUI (`ceo`) and LDAP ([[Ceo#raymo's guide on how to fix things after screwing up|guide from Raymond]]):


* Reset their password
* '''<u>Remove All Membership Terms</u>''': look for `memberTerm` in `ldapvi`
* '''<u>Reset their password</u>''' (**and don't tell them!**)


=== Step 2: Screw Up Their Account ===
=== Step 2: Screw Up Their Account ===


* '''<u>Change their Login Shell</u>''' (through LDAP) to something like `/sbin/nologin` or `/bin/false`
* Change their Login Shell (through LDAP - [[Ceo#raymo's guide on how to fix things after screwing up|guide here]]) to something like <code>/sbin/nologin</code> or <code>/bin/false</code>


'''NOTE''': CEO will not allow this change, so LDAP is best (and likely only way)
'''NOTE''': CEO will not allow this change, so LDAP is the best (and likely only way)


=== Step 3: Deauth Them Everywhere ===
=== Step 3: Deauth Them Everywhere ===


* '''<u>Suspend Kerberos</u>''': https://wiki.csclub.uwaterloo.ca/Kerberos#Suspending_an_Account
* Suspend Kerberos: https://wiki.csclub.uwaterloo.ca/Kerberos#Suspending_an_Account
* '''<u>Remove their SSH keys</u>''':
* Remove their SSH keys:
** Run <code>sudo -u <user_to_ban> mv ~<user_to_ban>/.ssh/{authorized_keys,banned_keys}</code> from a CSC machine.
** Go to a Syscom-only machine that could edit the `/users` directory ('''be extremely careful''')
** Navigate to the banned users directory, and remove their ssh keys (`.ssh/authorized_keys`)


=== Step 4: Remove all Their Resources ===
=== Step 4: Remove all Their Resources ===
Line 26: Line 22:
* '''<u>Remove their CSC Cloud VMs</u>''': https://wiki.csclub.uwaterloo.ca/CloudStack#Administration
* '''<u>Remove their CSC Cloud VMs</u>''': https://wiki.csclub.uwaterloo.ca/CloudStack#Administration
* (optional) Kill all processes they are running in General Use
* (optional) Kill all processes they are running in General Use
* (optional) Delete their home directory (eg. `/users/f3hadi` 🥲)
* (optional) Delete their home directory - '''ONLY if necessary'''

Latest revision as of 14:23, 10 October 2023

This is a (hopefully comprehensive) guide on ensuring their existing account (based on their WatIAM) is put out of action for good, and immediately. This guide is mainly intended for Syscom as it requires root or admin access to many CSC services.

Step 1: Remove Membership

Through CEO's TUI (ceo) :

  • Reset their password

Step 2: Screw Up Their Account

  • Change their Login Shell (through LDAP - guide here) to something like /sbin/nologin or /bin/false

NOTE: CEO will not allow this change, so LDAP is the best (and likely only way)

Step 3: Deauth Them Everywhere

Step 4: Remove all Their Resources

Retrieved from "https://wiki.csclub.uwaterloo.ca/index.php?title=How_to_(Extra)_Ban_Someone&oldid=5108"