Tighten up security model

[kocolosk]

I'm not sure what the full scope is here, but we've noted we want to make some changes to lock things down a bit more tightly. Tossing it in the board so we don't forget about it again.

[kocolosk]

Quoting @wohali on the deprecation of admin party:

I don't think it's the full #1504. Just new defaults, and we'll need to think thru what happens when starting up a node that has no [admins]. Do we create one and log its password to the logfile? What if logging is disabled / goes nowhere? Or do we simply refuse to start until an admin is created? What about crypting and salting the password ahead of time - do we introduce a small cli tool to generate passwords like apache/httpd does? Many questions.

[janl]

at least, we want to do the default database security setting to admin_only

[rnewson]

on admin_only, the fun one is the _users db. Users can currently update their own user doc, and we assert this in tests. In my PR (above), I'm updating tests to match the new default, but this one seems non-obvious to me. Do we want to require that all writes to _users must be with admin creds or do we want to continue with the unique property of per-doc authorization?

[janl]

Do we want to require that all writes to _users must be with admin creds or do we want to continue with the unique property of per-doc authorization?

In light of a “closed by default” security paradigm, I don’t see that the self-sign-up feature is something that should be on by default, but those who rely on this, should be able to opt into the old behaviour.

[janl]

sorry, left out the conclusion in my last comment:

I think just doing admin_only _users will be fine, folks will be able to disable it.

its not great that they won't be able to disable it JUST for _users, but I can live with that if it means that all we do here is a config defaults change and no new code.

[rnewson]

thanks

[rnewson]

Noting that #2339 is now merged. Is there more to be done here?

[janl]

I’d say #2389

[janl]

Which is merged now, so closing this: #2389