CouchDB: Prevent regular users from accessing Futon

[Hank Knight <hk...@gmail.com>]

I want to know how to block access to Futon (_utils) for CouchDB users
who are not administrators.

I create a user like this:
curl -k -u nlbdmobz@sharklasers.com:password123 \
 -X POST https://zqzqzqz555.couchappy.com/_users \
 -d "{\"_id\": \"org.couchdb.user:${username}\",\"name\":
\"${username}\",\"type\": \"user\",\"roles\": [],\"password\":
\"${password}\"}" -H "Content-Type: application/json"

How can I keep that user from accessing Futon?

Re: CouchDB: Prevent regular users from accessing Futon

[Dave Cottlehuber <dc...@jsonified.com>]

On 14. November 2013 at 21:54:22, Hank Knight (hknight555@gmail.com) wrote:
>  
> I want to know how to block access to Futon (_utils) for CouchDB  
> users
> who are not administrators.
>  
> I create a user like this:
> curl -k -u nlbdmobz@sharklasers.com:password123 \
> -X POST https://zqzqzqz555.couchappy.com/_users \
> -d "{\"_id\": \"org.couchdb.user:${username}\",\"name\":  
> \"${username}\",\"type\": \"user\",\"roles\": [],\"password\":  
> \"${password}\"}" -H "Content-Type: application/json"
>  
> How can I keep that user from accessing Futon?

Alex’s removing _utils is 50% of the answer; it’s security by obscurity (although still worth doing).

The most important point is to secure your database (validation docs, adding reader/member roles etc) because any futon-like interface can be pointed to a given couch instance. Whatever futon can do, a normal HTTP API can do.

A+
Dave

Re: CouchDB: Prevent regular users from accessing Futon

[Alexander Shorin <kx...@gmail.com>]

On Fri, Nov 15, 2013 at 1:39 AM, Jens Alfke <je...@couchbase.com> wrote:
> It might also be possible to remove the HTML files that make up Futon, though I’m not sure of their exact path in the installation.

Better to comment and remove _utils http handler:

[httpd_global_handlers]
;_utils = {couch_httpd_misc_handlers, handle_utils_dir_req,
"/usr/share/couchdb/www"}
_utils =


--
,,,^..^,,,

Re: CouchDB: Prevent regular users from accessing Futon

[Jens Alfke <je...@couchbase.com>]

On Nov 14, 2013, at 12:53 PM, Hank Knight <hk...@gmail.com> wrote:

> I want to know how to block access to Futon (_utils) for CouchDB users
> who are not administrators.

Set up a proxy/gateway and add a rule to block URIs with paths starting with “/_utils”?
It might also be possible to remove the HTML files that make up Futon, though I’m not sure of their exact path in the installation.

Why do you need to do this? Futon doesn’t let users do anything they can’t already do using the REST API, so you won’t be gaining any security by disabling it.

—Jens