Search code examples
buildbot

Disable anonymous access to buildbot web application

I've deployed buildbot in cloud vms, docker, and such. I've been able to setup authentication, but could not disable anonymous access.

It so happens that, I really can't allow anonymous access since it is a private owned resource, worst of all in many logs from build steps, passwords and other sensitive information show up.

buildbot version: 0.9.8

Documentation is scarse/nonexistant on this subject.

Thanks in advance.

Solution

  • Buildbot itself only allows to disable access to REST API. So anonymous users will see 'empty' web interface with no builds, logs etc. Access to the web interface can be disabled only by external web server settings.

    Example authz config:

    c['www']['authz'] = util.Authz(
    allowRules=[
        util.AnyEndpointMatcher(role='admins', defaultDeny=False),
        util.AnyControlEndpointMatcher(role='admins', defaultDeny=False),
        util.AnyEndpointMatcher(role='anonymous')
    ],

    2.5.12.5. Authorization rules

    One can implement the default deny policy by putting an AnyEndpointMatcher with nonexistent role in the end of the list. Please note that this will deny all REST apis, and most of the UI do not implement proper access denied message in case of such error.