{"action":"created","issue":{"url":"https://api.github.com/repos/buildbot/buildbot/issues/4026","repository_url":"https://api.github.com/repos/buildbot/buildbot","labels_url":"https://api.github.com/repos/buildbot/buildbot/issues/4026/labels{/name}","comments_url":"https://api.github.com/repos/buildbot/buildbot/issues/4026/comments","events_url":"https://api.github.com/repos/buildbot/buildbot/issues/4026/events","html_url":"https://github.com/buildbot/buildbot/issues/4026","id":311435279,"number":4026,"title":"authz defaults","user":{"login":"betafive","id":1632966,"avatar_url":"https://avatars2.githubusercontent.com/u/1632966?v=4","gravatar_id":"","url":"https://api.github.com/users/betafive","html_url":"https://github.com/betafive","followers_url":"https://api.github.com/users/betafive/followers","following_url":"https://api.github.com/users/betafive/following{/other_user}","gists_url":"https://api.github.com/users/betafive/gists{/gist_id}","starred_url":"https://api.github.com/users/betafive/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/betafive/subscriptions","organizations_url":"https://api.github.com/users/betafive/orgs","repos_url":"https://api.github.com/users/betafive/repos","events_url":"https://api.github.com/users/betafive/events{/privacy}","received_events_url":"https://api.github.com/users/betafive/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-04-05T00:29:23Z","updated_at":"2018-04-16T09:55:57Z","closed_at":null,"author_association":"NONE","body":"Just installed buildbot v1.1.0 on Ubuntu 16.04 and followed the tutorial (http://docs.buildbot.net/latest/tutorial/index.html). I've added builders, a change source, a scheduler and a worker and builds are being triggered from my git repository correctly.\r\n\r\nHowever, I can stop builds via the web interface. I can also pause/unpause workers. None of this required login. That's not really the default I'd expect.\r\n\r\nDocumentation on authentication plugins (http://docs.buildbot.net/latest/manual/cfg-www.html#authentication-plugins) says:\r\n\r\n> By default, Buildbot does not require people to authenticate in order to see the readonly data. In order to access control features in the web UI, you will need to configure an authentication plugin.\r\n\r\nSo I would assume no authentication plugin configured == readonly access.\r\n\r\nHowever, it looks like I need to explicitly set `c['www']['authz']` to enforce this. I've set what I think is the minimum configuration to enforce read-only access which is:\r\n\r\n`c['www']['authz'] = util.Authz(allowRules=[util.AnyControlEndpointMatcher(role=\"admins\")],roleMatchers=[])`\r\n\r\nI now still see buttons for various operations (like 'Stop' on a build) but clicking these leads to errors like `Cannot Stop: you need to have role 'admins'` which now appears to be safe.\r\n\r\nSo,\r\n\r\n1) Is this the correct change to lock down the web interface to become read-only?\r\n2) Would it be possible to update the defaults so that buildbot is secure out-of-the-box?\r\n3) Could the documentation be updated to make this clearer?\r\n\r\nLet me know if you need any more info."},"comment":{"url":"https://api.github.com/repos/buildbot/buildbot/issues/comments/381545567","html_url":"https://github.com/buildbot/buildbot/issues/4026#issuecomment-381545567","issue_url":"https://api.github.com/repos/buildbot/buildbot/issues/4026","id":381545567,"user":{"login":"betafive","id":1632966,"avatar_url":"https://avatars2.githubusercontent.com/u/1632966?v=4","gravatar_id":"","url":"https://api.github.com/users/betafive","html_url":"https://github.com/betafive","followers_url":"https://api.github.com/users/betafive/followers","following_url":"https://api.github.com/users/betafive/following{/other_user}","gists_url":"https://api.github.com/users/betafive/gists{/gist_id}","starred_url":"https://api.github.com/users/betafive/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/betafive/subscriptions","organizations_url":"https://api.github.com/users/betafive/orgs","repos_url":"https://api.github.com/users/betafive/repos","events_url":"https://api.github.com/users/betafive/events{/privacy}","received_events_url":"https://api.github.com/users/betafive/received_events","type":"User","site_admin":false},"created_at":"2018-04-16T09:55:57Z","updated_at":"2018-04-16T09:55:57Z","author_association":"NONE","body":"Something like this maybe:\r\n\r\n> By default, Buildbot does not require people to authenticate in order to access control features in the web UI. To secure Buildbot, you will need to configure an authentication plugin.\r\n\r\nThen there should be an example of a minimal, secure Buildbot master configuration. Here's what I've got in my master.cfg:\r\n\r\n    # minimalistic config to activate new web UI\r\n    c['www'] = dict(port=8010,\r\n                    plugins=dict(waterfall_view={}, console_view={}, grid_view={}),\r\n                    authz=util.Authz(allowRules=[util.AnyControlEndpointMatcher(role=\"admins\")],roleMatchers=[]))\r\n\r\nI think that's ok as I don't define any way for users to login and assume the 'admin' role."}}
{"actor":{"display_login":"betafive"}}