edX Solutions Team: Default LMS security settings changes (Matasano)

[martynjames]

These settings were required for a private fork after a 3rd party security review. It was desired to have the default settings be more secure by default, and let other environments (e.g. devstack.py) override the settings if they desire lower levels of security.

We may decide that this is unnecessary for main edx-platform, but worth considering. Thus this review starts the conversation.

[singingwolfboy]

Please update the comment above this line.

[martynjames]

@singingwolfboy - thanks; I updated the comment and added the correct override settings in test.py, so that test should run correctly too.

[jzoldak]

👍 from a test engineering perspective, tho I'm sure that devops needs to be included for review.
@e0d / @feanil

[fredsmith]

What is the maximum number of failed logins allowed? What actions will the user have to take to unlock their account again?

[chrisndodge]

There's a minimum wait period which is a CONFIG setting. I think the default is 15 minutes.

[ebporter]

Looks like there are 5-6 settings that we're changing:
enforcing the password policy (and changing it to be more strict)
enabling max log-in attempts (though I don't see a default value -- where does the operator change that value?)
hiding PII in the application logs (who gets access to those by default?)
preventing concurrent log-ins (which I personally feel is useful and some people definitely rely on, so I'm wondering if we want to disable this for edx.org)
and enabling "Advanced Security" (but I don't know what that means -- where can I see a list of items?)
On the surface, this change seems fine -- like a good idea, actually -- but I'd like to get these couple of questions answered first.

[singingwolfboy]

Now that we've sent an email to the edx-code mailing list about this PR, I think it's ready to merge. @martynjames, do you want to do so?