Use safer default values

[Kami]

This pull request updates the installer script to use more sane and safer default values.

It includes the following changes:

1. Update MongoDB to listen on localhost only (this is already the case in some versions but not all of them and it's better to be safe than sorry).
2. Enable authentication for MongoDB and create two users (admin and stackstorm). "stackstorm" user only has access to "st2" database and it's used by StackStorm components to authenticate against MongoDB.
3. Update RabbitMQ config to listen on localhost only by default (previously it listened on all the interfaces)
4. Update PostgreSQL config to listen on localhost only by default (already a default value on some distros)
5. Generate and use random password for Mistral PostgreSQL authentication.

Keep in mind that since those changes are done in the installer script, the only apply to single box installer only installation (doh). When users performs advanced / custom installation, package responsibility is only to get StackStorm components installed on the system - it's up to the user to handle authentication, configuration, etc.

TODO

• Documentation changes
  • Documentation on where users can find the password when using the installer script (note) - Add some security best practices notes to the docs st2docs#363
  • Update reference deployment and distributed / HA installation page and add a big red warning / notice which warns the user that they should enable authentication for MongoDB (point them to MongoDB docs) - Add some security best practices notes to the docs st2docs#363
• Tests which verify those three services are listening on localhost only - Verify services (MongoDB, RabbitMQ and PostgreSQL) only listen on localhost st2ci#71

[Kami]

Confirmed that the changes are working and ran basic sanity tests on:

• Ubuntu 14.04, Ubuntu 16.04
• Rhel 6
• Rhel 7

[Kami]

As an alternative, @enykeev suggested to to only configure services to listen / bind to localhost (without setting passwords).

I personally think doing both of them is better and setting a password for dependent services such as MongoDB, RabbitMQ and PostgreSQL is not problematic from the UX perspective, because unlike accessing StackStorm API, user shouldn't access those services directly and they are really just an "implementation detail".

If for some reason the user does need to access those services directly to debug things or similar, they can find passwords in the service config files (st2.conf, mistral.conf).

And having said that, we have already set a password for PostgreSQL database before that change, but it was a static and unsafe password.

[LindsayHill]

I'm totally in favour of switching to "only listen on localhost". Only thing we should maybe do is have a KB article or reference or something about it, saying "this is all you need for single-system install. You can change it if you need to, ST2 won't care. But if you do change it, follow these security precautions..."

For passwords on single-server systems, it's slightly different. I believe that we should encourage/enforce passwords, and I believe in using randomised passwords, rather than defaults. Users don't normally need to access databases, so it should be transparent. But we have to make sure that our docs include notes on how to find your password, and links on how to change it. Because inevitably people will sometimes need to access the DBs directly.

[Kami]

Yeah, I also need to point out and make it explicit that those changes (and installer script itself) is only meant for simple single-server "evaluation" / test deployments.

For advanced and production deployments it's up to the user to configure services, manage passwords, certificates, etc. We should of course document those best practices (see corresponding docs PR), but anything outside that is not really (nor should be) our responsibility.

[arm4b]

Let's use 127.0.0.1 where possible instead of localhost as we agreed before.

[Kami]

Agreed, I made that change in MongoDB and RabbitMQ, but I just followed what was already there for Mistral.

But yeah, I agree 127.0.0.1 is safer because localhost could cause issues with IPv6, etc.

[arm4b]

Same as in another comment:

Let's use 127.0.0.1 where possible instead of localhost as we agreed before.

[dzimine]

+1 on @LindsayHill
limiting to localhost is no-brainer,

for random password, I want to see the recovery procedure as people will need to access it (one idea is add them to script parameters and randomize only if not set by user),

for docs, let's do "Security hardening" section where we describe what needs to be done and
refer to the script (that's what our isntallation script is doing).

👍