Need access to cloudflare 2FA, please share it via 1password.

[Carreau]

A few people needed access to update DNS. (Yuvi, Simon Li), I'd like to give them delegate access.
Please add me to the relevant 1password group to have access to password and 2FA so that I can set that up;
Otherwise please add them to cloudflare as delegate.

Not having access is becoming limiting for some issues: jupyterhub/mybinder.org-deploy#3476

[yuvipanda]

I would love to be able to have this access back!

[choldgraf]

What is Jupyter's access policy for 2FA for DNS and CloudFlare? @Carreau has the security working group defined a practice here? (maybe @rpwagner has thoughts?)

I see mention of CloudFlare here but don't see any guidance about who should get access outside of the EC.

I'm happy to "just do it" but I don't want to violate some kind of security best practice if we've defined one.

[manics]

I've enabled 2FA on my cloudflare account (and I can't think of any reason why it shouldn't be required for everyone)

[choldgraf]

Maybe I'm mis-understanding this request, I think that @Carreau is asking for access to see the 2FA code for CloudFlare so that he can log in to the jupyter-wide CloudFlare account and make changes. Is that right?

[choldgraf]

Ah I just realized that @Carreau is on the security WG. @Carreau I've just added you to the vault so you should be able to see CloudFlare creds.

Since we didn't have a process for this, I'm going to share my rationale below:

• I think the Security Working Group should have access to all credentials for Jupyter. They need "trusted status" in order to be able to do their job.
• I went to the governance docs: https://jupyter.org/governance/
• I looked at the list of subprojects https://jupyter.org/governance/list-of-subprojects/
• Then clicked the security WG link: https://github.com/jupyter/security
• Saw @Carreau listed there

And concluded it was safe to add him to the vault so he has access.

In the future we should create a "Security WG group" in 1Password

I tried to do this but I don't seem to have the permissions in 1Password to do so.

[Carreau]

I don't see any new things/new vault.

From Yuvi's comment i'm not even sure 2FA is accessible in 1password, or has been added to 1password, I'm not even sure we know what kind of 2FA is setup.

#163 already lists issues with process, I'd love to help but I don't have access, It's also unclear how to was decided to use this process without asking the Sec WG.

As to who is part of what group, i've made jupyter/governance#313 to make it much simpler to keep who is in which group across many pages I'd love a merge

[Carreau]

can log in to the jupyter-wide CloudFlare account and make changes. Is that right

And yes, usually I can login with my credential and do modifications, but to add someone I need the main password and 2FA, the process would be:

• Login with Main Password/2FA
• add Yuvi and Simon
• Log-out.

This way Yuvi and Simon can login with their username/password/2FA without ever accessing the main password and 2FA.

and if my, Yuvi, or Simon account is compromised we can see in logs who made the changes (because they logged in as them, and not the main account).