"Retiring" a user can actually mean two things:
"retired", which disables their access to Tor hosts but keeps email working and then automatically stops after 186 days
"disabled", which immediately disables everything
How to retire a user
This is done by "locking" the account in howto/ldap, so it should simply be:
ssh db.torproject.org ud-lock account
Note that it's unclear if we should add an email alias in the
virtual file when the account expires, see ticket #32558 for
How to un-retire a user
To reverse the above, you need to restore those LDAP fields the way they were before. You can only do this by restoring from the howto/LDAP database. No, that is not fun at all. Be careful to avoid duplicate fields when you re-add them in ldapvi.
How to disable a user
This is done by removing all traces of the account:
- Login to alberti.torproject.org and lock the LDAP account using
- Login as admin to gitlab.torproject.org and disable the user account.
- Login to eugeni.torproject.org.
/etc/postfix/virtualand remove the account alias.
sudo postmap virtualto rebuild the virtual users table.
sudo remove_members <list names> <email address>
- make sure they don't have keys and accounts in Puppet
- remove the key from
There are other manual accounts that are not handled by LDAP. Make sure you check:
- Gitlab - remove the user from the config, as a cleanup (disabled users already do not have access to gitolite)