new security settings defaults

[Beth Porter]

Currently, in Open edX, our security settings are permissive by default, and the settings for our production environment (i.e edX.org) tighten up the security as a special case. In our next release, we will make the more secure settings our defaults, and loosen security for environments where it is warranted, such as development and testing.

As an Open edX operator, this means that you will notice the following defaults will change their state when you upgrade your instance:

• enforcing the password policy (we are changing it to be true)
• enabling max log-in attempts (we are changing this to be on)
• hiding PII in the application logs (we are changing this to be hidden)
• preventing concurrent log-ins (we are changing to to be true)
• enabling "Advanced Security" (we are changing this to be on)

We are also setting a minimum password length (to 8) and introducing simple password complexity logic:

+PASSWORD_COMPLEXITY = { "UPPER": 1, "LOWER": 1, "DIGITS": 1 }

To change these settings back to their current defaults using the Ansible deployment system, add the following settings to your configuration yml file before deployment:

EDXAPP_FEATURES:

  ENABLE_MAX_FAILED_LOGIN_ATTEMPTS: false

  ENFORCE_PASSWORD_POLICY: false

  SQUELCH_PII_IN_LOGS: false

  PREVENT_CONCURRENT_LOGINS: false

  ADVANCED_SECURITY: false

Additional details can be found here: https://github.com/edx/edx-platform/pull/5410/files

[Dmitry Ivanyushin]

Hi there,

I must be missing something. What does key ADVANCED_SECURITY supposed to do? Other keys seem self-explanatory, but not this one. :)

четверг, 8 января 2015 г., 19:15:14 UTC+3 пользователь Beth Porter написал:

[Jesse Zoldak]

The ADVANCED_SECURITY flag toggles the entire feature on or off, regardless of the settings in the ADVANCED_SECURITY_CONFIG dict.

Here's an example of how you can see it used in the codebase: https://github.com/edx/edx-platform/blob/master/common/djangoapps/student/models.py#L455

HTH.

-- JZ

[mahmedg...@gmail.com]

hi 

Beth Porter in my installation the settings are the same but for some reason it does not seem to work, i still can register a user with two digits password!.  could you help me solve this ??