Security without breaking MultiValue applications.

Authentication, durable privileges and hardened web sessions protect administrative surfaces while established account and Q-pointer workflows remain compatible.

01 / FIRST START

Replace bootstrap credentials immediately.

A new datastore creates the configured master identity, normally md, with its configured initial password, normally md. The values in .env create a user only when the USERS record is missing; they do not reset an existing password at restart. Log in locally and run CHANGE-PASSWORD md a-strong-new-password before exposing RightMV to another machine.

Additional users in MVDB_ADDITIONAL_USERS exist to make first IES startup practical. They receive their configured default account but no FILES or SYSTEM_ADMIN privilege.

02 / PRIVILEGES

Four independent persistent capabilities.

Authority comes from the enabled MVSYS USERS record. Granting one capability does not grant another. Account names and session OPTION values do not create administrative authority.

DEVELOPMENTFILES

Opens the /dev file workspace and permits structural file operations, file and folder imports, index maintenance and global cataloging. Normal application record access, compilation and local cataloging follow account entry instead. CLEAR-FILE may clear ordinary files for application compatibility; protected system files remain restricted.

OPERATING SYSTEMRUNOS

Permits guarded RUNOS and OS.EXECUTE commands when the server capability is enabled. The configured timeout and security audit still apply.

REMOTE TERMINALSSH_LOGIN

Permits password or mapped public-key authentication through the optional SSH terminal. The listener must also be configured and licensed with the Professional SSH_TERMINAL feature.

ADMINISTRATIONSYSTEM_ADMIN

Permits /run and debugger control, process and lock administration, storage switching, account management, application administration, whole-system import/export and global HTTP-listener control. LISTU and read-only STORAGE remain available without it.

03 / ACCOUNT ENTRY AND MASTER

Keep application access separate from platform administration.

After an authenticated login, ordinary LOGTO/TO operations and Q-pointer reads and writes remain available for application compatibility. Compile is usable after the user enters the source account. Local cataloging follows account entry; global cataloging requires FILES.

The configured master identity, normally md, has all four effective privileges while enabled. Only that identity—not merely a user with SYSTEM_ADMIN—may create, enable, disable or delete users and grant or revoke privileges. Any enabled user may change their own password.

An administrator may add a separate password to an account. RightMV stores only a salted PBKDF2 verifier in attribute 10 of MVSYS ACCOUNTS and prompts on initial entry, interactive LOGTO and web account unlock. Accounts without a verifier behave exactly as before. User privileges, account passwords, IES application roles and Professional licence features are separate controls.

04 / COMMANDS

Administer supported records through TCL.

Passwords are redacted from TCL logging and are never displayed by LIST-USERS.

CHANGE-PASSWORD username new-password

Change your own password; the master may reset another user's password.

CREATE-USER username password [account]

Create an enabled login with a validated initial account.

ENABLE-USER / DISABLE-USER username

Master-only login status controls.

GRANT-PRIVILEGE username FILES|RUNOS|SSH_LOGIN|SYSTEM_ADMIN

Persistently grant one explicit capability.

REVOKE-PRIVILEGE username FILES|RUNOS|SSH_LOGIN|SYSTEM_ADMIN

Persistently remove one explicit capability.

SET-ACCOUNT-PASSWORD account password

SYSTEM_ADMIN-only optional account-entry password.

CLEAR-ACCOUNT-PASSWORD account

SYSTEM_ADMIN-only removal of an account-entry password.

05 / WEB BOUNDARY

Authenticate every administrative surface.

/dev requires FILES for file access and SYSTEM_ADMIN for its debugger panes. /run requires SYSTEM_ADMIN. Server-side sessions use opaque identifiers, rotate at login, expire after inactivity and are invalidated at logout. State-changing browser requests enforce CSRF and same-origin checks, and repeated failed logins are rate-limited.

Keep listeners on trusted interfaces. Use HTTPS through a trusted reverse proxy for remote access so Secure cookies and credentials are protected in transit.

06 / AUDIT

Record security decisions without console noise.

Set both MVDB_LOG_ENABLED=true and MVDB_LOG_AUDIT=true to write authentication, authorization, CSRF and administrative events to logs/audit.log. Audit events do not go to the service console. Configure rotation and protect access to the log directory.

Audit records support investigation; they do not replace operating-system access controls, TLS, backups, monitoring or application-level authorization.