Repository: nats-io/nats-server
Pull request #1434 (2020-05-30 00:58:06)

System Account on by default.
Most of the changes are to turn it off for tests that were watching subscriptions and such.

Signed-off-by: Derek Collison <derek@nats.io>

/cc @nats-io/core



Patch:
diff --git a/server/configs/reload/srv_a_1.conf b/server/configs/reload/srv_a_1.conf
index f915c8b9..a3be57e8 100644
--- a/server/configs/reload/srv_a_1.conf
+++ b/server/configs/reload/srv_a_1.conf
@@ -9,3 +9,5 @@ cluster {
     nats-route://127.0.0.1:7246
   ]
 }
+
+no_sys_acc: true
diff --git a/server/configs/reload/srv_a_2.conf b/server/configs/reload/srv_a_2.conf
index 373ae0d8..fd8a542c 100644
--- a/server/configs/reload/srv_a_2.conf
+++ b/server/configs/reload/srv_a_2.conf
@@ -9,3 +9,5 @@ cluster {
     nats-route://tyler:foo@127.0.0.1:7246 # Use route credentials
   ]
 }
+
+no_sys_acc: true
diff --git a/server/configs/reload/srv_a_3.conf b/server/configs/reload/srv_a_3.conf
index 391062c9..fd7fe291 100644
--- a/server/configs/reload/srv_a_3.conf
+++ b/server/configs/reload/srv_a_3.conf
@@ -9,3 +9,5 @@ cluster {
     nats-route://127.0.0.1:7247 # Remove srv b route and add srv c
   ]
 }
+
+no_sys_acc: true
diff --git a/server/configs/reload/srv_a_4.conf b/server/configs/reload/srv_a_4.conf
index 77258f3d..3b064c05 100644
--- a/server/configs/reload/srv_a_4.conf
+++ b/server/configs/reload/srv_a_4.conf
@@ -5,3 +5,5 @@ listen: 127.0.0.1:-1
 cluster {
   listen: 127.0.0.1:7244
 }
+
+no_sys_acc: true
diff --git a/server/configs/reload/srv_b_1.conf b/server/configs/reload/srv_b_1.conf
index 426e2dab..27b6dcf6 100644
--- a/server/configs/reload/srv_b_1.conf
+++ b/server/configs/reload/srv_b_1.conf
@@ -5,3 +5,5 @@ listen: 127.0.0.1:-1
 cluster {
   listen: 127.0.0.1:7246
 }
+
+no_sys_acc: true
diff --git a/server/configs/reload/srv_b_2.conf b/server/configs/reload/srv_b_2.conf
index f16d5baf..68c4a9cc 100644
--- a/server/configs/reload/srv_b_2.conf
+++ b/server/configs/reload/srv_b_2.conf
@@ -11,3 +11,5 @@ cluster {
     password: foo
   }
 }
+
+no_sys_acc: true
diff --git a/server/configs/reload/srv_c_1.conf b/server/configs/reload/srv_c_1.conf
index 4bfb7ffb..553bdb2b 100644
--- a/server/configs/reload/srv_c_1.conf
+++ b/server/configs/reload/srv_c_1.conf
@@ -5,3 +5,5 @@ listen: 127.0.0.1:-1
 cluster {
   listen: 127.0.0.1:7247
 }
+
+no_sys_acc: true
diff --git a/server/opts.go b/server/opts.go
index 8e851ec9..3326aa27 100644
--- a/server/opts.go
+++ b/server/opts.go
@@ -168,6 +168,7 @@ type Options struct {
 	Accounts              []*Account    `json:"-"`
 	NoAuthUser            string        `json:"-"`
 	SystemAccount         string        `json:"-"`
+	NoSystemAccount       bool          `json:"-"`
 	AllowNewAccounts      bool          `json:"-"`
 	Username              string        `json:"-"`
 	Password              string        `json:"-"`
@@ -841,6 +842,8 @@ func (o *Options) processConfigFileLine(k string, v interface{}, errors *[]error
 		// Already processed at the beginning so we just skip them
 		// to not treat them as unknown values.
 		return
+	case "no_system_account", "no_system", "no_sys_acc":
+		o.NoSystemAccount = v.(bool)
 	case "trusted", "trusted_keys":
 		switch v := v.(type) {
 		case string:
diff --git a/server/server.go b/server/server.go
index 2e5bec36..1c952b59 100644
--- a/server/server.go
+++ b/server/server.go
@@ -471,7 +471,7 @@ func (s *Server) globalAccount() *Account {
 // Used to setup Accounts.
 // Lock is held upon entry.
 func (s *Server) configureAccounts() error {
-	// Create global account.
+	// Create the global account.
 	if s.gacc == nil {
 		s.gacc = NewAccount(globalAccountName)
 		s.registerAccountNoLock(s.gacc)
@@ -546,6 +546,7 @@ func (s *Server) configureAccounts() error {
 	}
 
 	// Set the system account if it was configured.
+	// Otherwise create a default one.
 	if opts.SystemAccount != _EMPTY_ {
 		// Lock may be acquired in lookupAccount, so release to call lookupAccount.
 		s.mu.Unlock()
@@ -768,7 +769,7 @@ func (s *Server) NewAccountsAllowed() bool {
 }
 
 // numReservedAccounts will return the number of reserved accounts configured in the server.
-// Currently this is 1 for the global default service.
+// Currently this is 1, one for the global default account.
 func (s *Server) numReservedAccounts() int {
 	return 1
 }
@@ -1224,7 +1225,7 @@ func (s *Server) Start() {
 	}
 	s.Noticef("Git commit [%s]", gc)
 
-	// Check for insecure configurations.op
+	// Check for insecure configurations.
 	s.checkAuthforWarnings()
 
 	// Avoid RACE between Start() and Shutdown()
@@ -1272,6 +1273,9 @@ func (s *Server) Start() {
 			s.Fatalf("Can't set system account: %v", err)
 			return
 		}
+	} else if !opts.NoSystemAccount {
+		// We will create a default system account here.
+		s.SetDefaultSystemAccount()
 	}
 
 	// Start expiration of mapped GW replies, regardless if


Test patch:
diff --git a/server/accounts_test.go b/server/accounts_test.go
index 40954143..45280bb7 100644
--- a/server/accounts_test.go
+++ b/server/accounts_test.go
@@ -169,7 +169,7 @@ func TestActiveAccounts(t *testing.T) {
 	defer s.Shutdown()
 
 	if s.NumActiveAccounts() != 0 {
-		t.Fatalf("Expected no active accounts, got %d", s.NumActiveAccounts())
+		t.Fatalf("Expected no active account, got %d", s.NumActiveAccounts())
 	}
 
 	addClientWithAccount := func(accName string) *testAsyncClient {
@@ -1457,15 +1457,6 @@ func TestAccountRequestReplyTrackLatency(t *testing.T) {
 
 	// Now let's add in tracking
 
-	// This looks ok but should fail because we have not set a system account needed for internal msgs.
-	if err := fooAcc.TrackServiceExport("track.service", "results"); err != ErrNoSysAccount {
-		t.Fatalf("Expected error enabling tracking latency without a system account")
-	}
-
-	if err := s.SetSystemAccount(globalAccountName); err != nil {
-		t.Fatalf("Error setting system account: %v", err)
-	}
-
 	// First check we get an error if service does not exist.
 	if err := fooAcc.TrackServiceExport("track.wrong", "results"); err != ErrMissingService {
 		t.Fatalf("Expected error enabling tracking latency for wrong service")
@@ -1503,7 +1494,7 @@ func TestAccountRequestReplyTrackLatency(t *testing.T) {
 		t.Helper()
 		l, err := crFoo.ReadString('\n')
 		if err != nil {
-			t.Fatalf("Error reading from client 'bar': %v", err)
+			t.Fatalf("Error reading from client 'foo': %v", err)
 		}
 		mraw := msgPat.FindAllStringSubmatch(l, -1)
 		if len(mraw) == 0 {
diff --git a/server/client_test.go b/server/client_test.go
index 5da8f46c..48294251 100644
--- a/server/client_test.go
+++ b/server/client_test.go
@@ -46,6 +46,7 @@ type serverInfo struct {
 	Headers      bool     `json:"headers"`
 	ConnectURLs  []string `json:"connect_urls,omitempty"`
 	LameDuckMode bool     `json:"ldm,omitempty"`
+	CID          uint64   `json:"client_id,omitempty"`
 }
 
 type testAsyncClient struct {
@@ -1997,19 +1998,27 @@ func TestNoClientLeakOnSlowConsumer(t *testing.T) {
 	}
 	defer c.Close()
 
-	var buf [1024]byte
+	cr := bufio.NewReader(c)
+
 	// Wait for INFO...
-	c.Read(buf[:])
+	line, _, _ := cr.ReadLine()
+	var info serverInfo
+	if err = json.Unmarshal(line[5:], &info); err != nil {
+		t.Fatalf("Could not parse INFO json: %v\n", err)
+	}
 
 	// Send our connect
-	if _, err := c.Write([]byte("CONNECT {}\r\nSUB foo 1\r\nPING\r\n")); err != nil {
+	if _, err := c.Write([]byte("CONNECT {\"verbose\": false}\r\nSUB foo 1\r\nPING\r\n")); err != nil {
 		t.Fatalf("Error sending CONNECT and SUB: %v", err)
 	}
 	// Wait for PONG
-	c.Read(buf[:])
+	line, _, _ = cr.ReadLine()
+	if string(line) != "PONG" {
+		t.Fatalf("Expected 'PONG' but got %q", line)
+	}
 
 	// Get the client from server map
-	cli := s.GetClient(1)
+	cli := s.GetClient(info.CID)
 	if cli == nil {
 		t.Fatalf("No client registered")
 	}
@@ -2126,7 +2135,8 @@ func TestClientIPv6Address(t *testing.T) {
 	}
 	defer nc.Close()
 
-	c := s.GetClient(1)
+	cid, _ := nc.GetClientID()
+	c := s.GetClient(cid)
 	c.mu.Lock()
 	ncs := c.ncs
 	c.mu.Unlock()
diff --git a/server/closed_conns_test.go b/server/closed_conns_test.go
index 52d95349..cd8954c6 100644
--- a/server/closed_conns_test.go
+++ b/server/closed_conns_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018-2019 The NATS Authors
+// Copyright 2018-2020 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -46,6 +46,7 @@ func checkTotalClosedConns(t *testing.T, s *Server, num uint64, wait time.Durati
 func TestClosedConnsAccounting(t *testing.T) {
 	opts := DefaultOptions()
 	opts.MaxClosedClients = 10
+	opts.NoSystemAccount = true
 
 	s := RunServer(opts)
 	defer s.Shutdown()
@@ -56,6 +57,7 @@ func TestClosedConnsAccounting(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error on connect: %v", err)
 	}
+	id, _ := nc.GetClientID()
 	nc.Close()
 
 	checkClosedConns(t, s, 1, wait)
@@ -64,8 +66,8 @@ func TestClosedConnsAccounting(t *testing.T) {
 	if lc := len(conns); lc != 1 {
 		t.Fatalf("len(conns) expected to be %d, got %d\n", 1, lc)
 	}
-	if conns[0].Cid != 1 {
-		t.Fatalf("Expected CID to be 1, got %d\n", conns[0].Cid)
+	if conns[0].Cid != id {
+		t.Fatalf("Expected CID to be %d, got %d\n", id, conns[0].Cid)
 	}
 
 	// Now create 21 more
diff --git a/server/gateway_test.go b/server/gateway_test.go
index 0ebcdaf9..d38dc548 100644
--- a/server/gateway_test.go
+++ b/server/gateway_test.go
@@ -238,6 +238,7 @@ func natsUnsub(t *testing.T, sub *nats.Subscription) {
 
 func testDefaultOptionsForGateway(name string) *Options {
 	o := DefaultOptions()
+	o.NoSystemAccount = true
 	o.ServerName = name
 	o.Gateway.Name = name
 	o.Gateway.Host = "127.0.0.1"
@@ -393,6 +394,7 @@ func TestGatewayIgnoreSelfReference(t *testing.T) {
 		URLs: []*url.URL{u},
 	}
 	o.Gateway.Gateways = append(o.Gateway.Gateways, cfg)
+	o.NoSystemAccount = true
 	s := runGatewayServer(o)
 	defer s.Shutdown()
 
diff --git a/server/monitor_test.go b/server/monitor_test.go
index 9f378c5d..8006ea44 100644
--- a/server/monitor_test.go
+++ b/server/monitor_test.go
@@ -1,4 +1,4 @@
-// Copyright 2013-2019 The NATS Authors
+// Copyright 2013-2020 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -57,12 +57,14 @@ func DefaultMonitorOptions() *Options {
 func runMonitorServer() *Server {
 	resetPreviousHTTPConnections()
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	return RunServer(opts)
 }
 
 func runMonitorServerWithAccounts() *Server {
 	resetPreviousHTTPConnections()
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	aA := NewAccount("A")
 	aB := NewAccount("B")
 	opts.Accounts = append(opts.Accounts, aA, aB)
@@ -75,6 +77,7 @@ func runMonitorServerWithAccounts() *Server {
 func runMonitorServerNoHTTPPort() *Server {
 	resetPreviousHTTPConnections()
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	opts.HTTPPort = 0
 	return RunServer(opts)
 }
@@ -163,6 +166,7 @@ func readBodyEx(t *testing.T, url string, status int, content string) []byte {
 func TestHTTPBasePath(t *testing.T) {
 	resetPreviousHTTPConnections()
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	opts.HTTPBasePath = "/nats"
 
 	s := RunServer(opts)
@@ -923,6 +927,7 @@ func TestConnzSortedBySubs(t *testing.T) {
 func TestConnzSortedByLast(t *testing.T) {
 	resetPreviousHTTPConnections()
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	s := RunServer(opts)
 	defer s.Shutdown()
 
@@ -1261,6 +1266,7 @@ func pollRoutez(t *testing.T, s *Server, mode int, url string, opts *RoutezOptio
 func TestConnzWithRoutes(t *testing.T) {
 	resetPreviousHTTPConnections()
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	opts.Cluster.Host = "127.0.0.1"
 	opts.Cluster.Port = CLUSTER_PORT
 
@@ -1274,8 +1280,9 @@ func TestConnzWithRoutes(t *testing.T) {
 			Host: "127.0.0.1",
 			Port: -1,
 		},
-		NoLog:  true,
-		NoSigs: true,
+		NoLog:           true,
+		NoSigs:          true,
+		NoSystemAccount: true,
 	}
 	routeURL, _ := url.Parse(fmt.Sprintf("nats-route://127.0.0.1:%d", s.ClusterAddr().Port))
 	opts.Routes = []*url.URL{routeURL}
@@ -1808,6 +1815,7 @@ func TestConnzClosedConnsBadTLSClient(t *testing.T) {
 
 	var err error
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	opts.TLSTimeout = 1.5 // 1.5 seconds
 	opts.TLSConfig, err = GenTLSConfig(tc)
 	if err != nil {
@@ -1972,6 +1980,7 @@ func TestMonitorHandler(t *testing.T) {
 func TestMonitorRoutezRace(t *testing.T) {
 	resetPreviousHTTPConnections()
 	srvAOpts := DefaultMonitorOptions()
+	srvAOpts.NoSystemAccount = true
 	srvAOpts.Cluster.Port = -1
 	srvA := RunServer(srvAOpts)
 	defer srvA.Shutdown()
@@ -2016,6 +2025,7 @@ func TestConnzTLSInHandshake(t *testing.T) {
 
 	var err error
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	opts.TLSTimeout = 1.5 // 1.5 seconds
 	opts.TLSConfig, err = GenTLSConfig(tc)
 	if err != nil {
@@ -2122,6 +2132,7 @@ func TestClusterEmptyWhenNotDefined(t *testing.T) {
 func TestRoutezPermissions(t *testing.T) {
 	resetPreviousHTTPConnections()
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	opts.Cluster.Host = "127.0.0.1"
 	opts.Cluster.Port = -1
 	opts.Cluster.Permissions = &RoutePermissions{
@@ -2352,6 +2363,7 @@ func testMonitorStructPresent(t *testing.T, tag string) {
 
 	resetPreviousHTTPConnections()
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	s := RunServer(opts)
 	defer s.Shutdown()
 
@@ -2367,6 +2379,7 @@ func TestMonitorCluster(t *testing.T) {
 
 	resetPreviousHTTPConnections()
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	opts.Cluster.Port = -1
 	opts.Cluster.AuthTimeout = 1
 	opts.Routes = RoutesFromStr("nats://127.0.0.1:1234")
@@ -2510,6 +2523,7 @@ func TestMonitorGateway(t *testing.T) {
 
 	resetPreviousHTTPConnections()
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	opts.Gateway.Name = "A"
 	opts.Gateway.Port = -1
 	opts.Gateway.AuthTimeout = 1
@@ -2683,6 +2697,7 @@ func TestMonitorLeafNode(t *testing.T) {
 
 	resetPreviousHTTPConnections()
 	opts := DefaultMonitorOptions()
+	opts.NoSystemAccount = true
 	opts.LeafNode.Port = -1
 	opts.LeafNode.AuthTimeout = 1
 	opts.LeafNode.TLSTimeout = 1
@@ -2982,6 +2997,7 @@ func TestMonitorGatewayzAccounts(t *testing.T) {
 			name: "B"
 			port: -1
 		}
+		no_sys_acc = true
 	`, accounts)))
 	defer os.Remove(bConf)
 
@@ -3006,6 +3022,7 @@ func TestMonitorGatewayzAccounts(t *testing.T) {
 				}
 			]
 		}
+		no_sys_acc = true
 	`, accounts, sb.GatewayAddr().Port)))
 	defer os.Remove(aConf)
 
diff --git a/server/norace_test.go b/server/norace_test.go
index 9c700aa4..ac03684d 100644
--- a/server/norace_test.go
+++ b/server/norace_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018-2019 The NATS Authors
+// Copyright 2018-2020 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -36,6 +36,7 @@ import (
 
 func TestNoRaceAvoidSlowConsumerBigMessages(t *testing.T) {
 	opts := DefaultOptions() // Use defaults to make sure they avoid pending slow consumer.
+	opts.NoSystemAccount = true
 	s := RunServer(opts)
 	defer s.Shutdown()
 
@@ -96,6 +97,7 @@ func TestNoRaceAvoidSlowConsumerBigMessages(t *testing.T) {
 func TestNoRaceRoutedQueueAutoUnsubscribe(t *testing.T) {
 	optsA, _ := ProcessConfigFile("./configs/seed.conf")
 	optsA.NoSigs, optsA.NoLog = true, true
+	optsA.NoSystemAccount = true
 	srvA := RunServer(optsA)
 	defer srvA.Shutdown()
 
@@ -190,6 +192,7 @@ func TestNoRaceRoutedQueueAutoUnsubscribe(t *testing.T) {
 
 func TestNoRaceClosedSlowConsumerWriteDeadline(t *testing.T) {
 	opts := DefaultOptions()
+	opts.NoSystemAccount = true
 	opts.WriteDeadline = 10 * time.Millisecond // Make very small to trip.
 	opts.MaxPending = 500 * 1024 * 1024        // Set high so it will not trip here.
 	s := RunServer(opts)
@@ -237,6 +240,7 @@ func TestNoRaceClosedSlowConsumerWriteDeadline(t *testing.T) {
 
 func TestNoRaceClosedSlowConsumerPendingBytes(t *testing.T) {
 	opts := DefaultOptions()
+	opts.NoSystemAccount = true
 	opts.WriteDeadline = 30 * time.Second // Wait for long time so write deadline does not trigger slow consumer.
 	opts.MaxPending = 1 * 1024 * 1024     // Set to low value (1MB) to allow SC to trip.
 	s := RunServer(opts)
@@ -284,6 +288,7 @@ func TestNoRaceClosedSlowConsumerPendingBytes(t *testing.T) {
 
 func TestNoRaceSlowConsumerPendingBytes(t *testing.T) {
 	opts := DefaultOptions()
+	opts.NoSystemAccount = true
 	opts.WriteDeadline = 30 * time.Second // Wait for long time so write deadline does not trigger slow consumer.
 	opts.MaxPending = 1 * 1024 * 1024     // Set to low value (1MB) to allow SC to trip.
 	s := RunServer(opts)
@@ -615,10 +620,12 @@ func TestNoRaceRouteCache(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 
 			oa := DefaultOptions()
+			oa.NoSystemAccount = true
 			sa := RunServer(oa)
 			defer sa.Shutdown()
 
 			ob := DefaultOptions()
+			ob.NoSystemAccount = true
 			ob.Routes = RoutesFromStr(fmt.Sprintf("nats://%s:%d", oa.Cluster.Host, oa.Cluster.Port))
 			sb := RunServer(ob)
 			defer sb.Shutdown()
@@ -811,6 +818,7 @@ func TestNoRaceFetchAccountDoesNotRegisterAccountTwice(t *testing.T) {
 
 func TestNoRaceWriteDeadline(t *testing.T) {
 	opts := DefaultOptions()
+	opts.NoSystemAccount = true
 	opts.WriteDeadline = 30 * time.Millisecond
 	s := RunServer(opts)
 	defer s.Shutdown()
diff --git a/server/opts_test.go b/server/opts_test.go
index fb2d693e..f1355826 100644
--- a/server/opts_test.go
+++ b/server/opts_test.go
@@ -1,4 +1,4 @@
-// Copyright 2012-2019 The NATS Authors
+// Copyright 2012-2020 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -2311,6 +2311,7 @@ func TestSublistNoCacheConfigOnAccounts(t *testing.T) {
 			users [ {nkey : UC6NLCN7AS34YOJVCYD4PJ3QB7QGLYG5B5IMBT25VW5K4TNUJODM7BOX} ]
 		}
 	  }
+	  no_sys_acc = true
     `))
 	defer os.Remove(confFileName)
 
diff --git a/server/reload_test.go b/server/reload_test.go
index 51f6557c..d32651ad 100644
--- a/server/reload_test.go
+++ b/server/reload_test.go
@@ -1,4 +1,4 @@
-// Copyright 2017-2019 The NATS Authors
+// Copyright 2017-2020 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -2076,6 +2076,7 @@ func TestConfigReloadClusterPerms(t *testing.T) {
 				}
 			}
 		}
+		no_sys_acc: true
 	`
 	confA := createConfFile(t, []byte(fmt.Sprintf(confATemplate, `"foo"`, `"foo"`)))
 	defer os.Remove(confA)
@@ -2098,6 +2099,7 @@ func TestConfigReloadClusterPerms(t *testing.T) {
 				"nats://127.0.0.1:%d"
 			]
 		}
+		no_sys_acc: true
 	`
 	confB := createConfFile(t, []byte(fmt.Sprintf(confBTemplate, `"foo"`, `"foo"`, srva.ClusterAddr().Port)))
 	defer os.Remove(confB)
@@ -2234,6 +2236,7 @@ func TestConfigReloadClusterPerms(t *testing.T) {
 		cluster {
 			listen: 127.0.0.1:-1
 		}
+		no_sys_acc: true
 	`)
 	// Server A should now have baz sub
 	checkExpectedSubs(t, 5, srvb)
@@ -2253,6 +2256,7 @@ func TestConfigReloadClusterPerms(t *testing.T) {
 				"nats://127.0.0.1:%d"
 			]
 		}
+		no_sys_acc: true
 	`, srva.ClusterAddr().Port))
 	// Check expected subscriptions count.
 	checkExpectedSubs(t, 5, srvb)
@@ -2270,6 +2274,7 @@ func TestConfigReloadClusterPermsImport(t *testing.T) {
 				}
 			}
 		}
+		no_sys_acc: true
 	`
 	confA := createConfFile(t, []byte(fmt.Sprintf(confATemplate, `["foo", "bar"]`)))
 	defer os.Remove(confA)
@@ -2284,6 +2289,7 @@ func TestConfigReloadClusterPermsImport(t *testing.T) {
 				"nats://127.0.0.1:%d"
 			]
 		}
+		no_sys_acc: true
 	`
 	confB := createConfFile(t, []byte(fmt.Sprintf(confBTemplate, srva.ClusterAddr().Port)))
 	defer os.Remove(confB)
@@ -2326,6 +2332,7 @@ func TestConfigReloadClusterPermsImport(t *testing.T) {
 				export: ">"
 			}
 		}
+		no_sys_acc: true
 	`)
 	checkExpectedSubs(t, 2, srva, srvb)
 
@@ -2340,6 +2347,7 @@ func TestConfigReloadClusterPermsImport(t *testing.T) {
 				}
 			}
 		}
+		no_sys_acc: true
 	`
 	// Now deny all:
 	reloadUpdateConfig(t, srva, confA, fmt.Sprintf(confATemplate, `["foo", "bar"]`))
@@ -2363,6 +2371,7 @@ func TestConfigReloadClusterPermsExport(t *testing.T) {
 				}
 			}
 		}
+		no_sys_acc: true
 	`
 	confA := createConfFile(t, []byte(fmt.Sprintf(confATemplate, `["foo", "bar"]`)))
 	defer os.Remove(confA)
@@ -2377,6 +2386,7 @@ func TestConfigReloadClusterPermsExport(t *testing.T) {
 				"nats://127.0.0.1:%d"
 			]
 		}
+		no_sys_acc: true
 	`
 	confB := createConfFile(t, []byte(fmt.Sprintf(confBTemplate, srva.ClusterAddr().Port)))
 	defer os.Remove(confB)
@@ -2419,6 +2429,7 @@ func TestConfigReloadClusterPermsExport(t *testing.T) {
 				import: ">"
 			}
 		}
+		no_sys_acc: true
 	`)
 	checkExpectedSubs(t, 2, srva, srvb)
 
@@ -2433,6 +2444,7 @@ func TestConfigReloadClusterPermsExport(t *testing.T) {
 				}
 			}
 		}
+		no_sys_acc: true
 	`
 	// Now deny all:
 	reloadUpdateConfig(t, srva, confA, fmt.Sprintf(confATemplate, `["foo", "bar"]`))
@@ -2867,6 +2879,7 @@ func TestConfigReloadAccountStreamsImportExport(t *testing.T) {
 			]
 		}
 	}
+	no_sys_acc: true
 	`
 	// synadia account exports "private.>" to nats.io
 	// synadia account exports "foo.*"
@@ -3059,6 +3072,7 @@ func TestConfigReloadAccountServicesImportExport(t *testing.T) {
 			]
 		}
 	}
+	no_sys_acc: true
 	`))
 	defer os.Remove(conf)
 	s, opts := RunServerWithConfig(conf)
@@ -3157,6 +3171,7 @@ func TestConfigReloadAccountServicesImportExport(t *testing.T) {
 			]
 		}
 	}
+	no_sys_acc: true
 	`)
 	// This still should work
 	req(t, ivan, "foo", "reply1")
@@ -3192,6 +3207,7 @@ func TestConfigReloadNotPreventedByGateways(t *testing.T) {
 				}
 			]
 		}
+		no_sys_acc: true
 	`
 	conf := createConfFile(t, []byte(fmt.Sprintf(confTemplate, "", "5")))
 	defer os.Remove(conf)
diff --git a/server/routes_test.go b/server/routes_test.go
index 344906f1..1aaa8e35 100644
--- a/server/routes_test.go
+++ b/server/routes_test.go
@@ -1,4 +1,4 @@
-// Copyright 2013-2019 The NATS Authors
+// Copyright 2013-2020 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -310,6 +310,7 @@ func TestSeedSolicitWorks(t *testing.T) {
 	optsSeed, _ := ProcessConfigFile("./configs/seed.conf")
 
 	optsSeed.NoSigs, optsSeed.NoLog = true, true
+	optsSeed.NoSystemAccount = true
 
 	srvSeed := RunServer(optsSeed)
 	defer srvSeed.Shutdown()
@@ -366,6 +367,7 @@ func TestTLSSeedSolicitWorks(t *testing.T) {
 	optsSeed, _ := ProcessConfigFile("./configs/seed_tls.conf")
 
 	optsSeed.NoSigs, optsSeed.NoLog = true, true
+	optsSeed.NoSystemAccount = true
 
 	srvSeed := RunServer(optsSeed)
 	defer srvSeed.Shutdown()
@@ -422,6 +424,7 @@ func TestChainedSolicitWorks(t *testing.T) {
 	optsSeed, _ := ProcessConfigFile("./configs/seed.conf")
 
 	optsSeed.NoSigs, optsSeed.NoLog = true, true
+	optsSeed.NoSystemAccount = true
 
 	srvSeed := RunServer(optsSeed)
 	defer srvSeed.Shutdown()
@@ -480,7 +483,7 @@ func TestChainedSolicitWorks(t *testing.T) {
 // expected number of subscriptions.
 func checkExpectedSubs(t *testing.T, expected int, servers ...*Server) {
 	t.Helper()
-	checkFor(t, 10*time.Second, 10*time.Millisecond, func() error {
+	checkFor(t, 4*time.Second, 10*time.Millisecond, func() error {
 		for _, s := range servers {
 			if numSubs := int(s.NumSubscriptions()); numSubs != expected {
 				return fmt.Errorf("Expected %d subscriptions for server %q, got %d", expected, s.ID(), numSubs)
@@ -494,6 +497,7 @@ func TestTLSChainedSolicitWorks(t *testing.T) {
 	optsSeed, _ := ProcessConfigFile("./configs/seed_tls.conf")
 
 	optsSeed.NoSigs, optsSeed.NoLog = true, true
+	optsSeed.NoSystemAccount = true
 
 	srvSeed := RunServer(optsSeed)
 	defer srvSeed.Shutdown()
@@ -1013,6 +1017,7 @@ func TestRoutePermsAppliedOnInboundAndOutboundRoute(t *testing.T) {
 func TestRouteSendLocalSubsWithLowMaxPending(t *testing.T) {
 	optsA := DefaultOptions()
 	optsA.MaxPending = 1024
+	optsA.NoSystemAccount = true
 	srvA := RunServer(optsA)
 	defer srvA.Shutdown()
 
@@ -1031,6 +1036,7 @@ func TestRouteSendLocalSubsWithLowMaxPending(t *testing.T) {
 	// Now create a route between B and A
 	optsB := DefaultOptions()
 	optsB.Routes = RoutesFromStr(fmt.Sprintf("nats://%s:%d", optsA.Cluster.Host, optsA.Cluster.Port))
+	optsB.NoSystemAccount = true
 	srvB := RunServer(optsB)
 	defer srvB.Shutdown()
 
diff --git a/server/server_test.go b/server/server_test.go
index e25f42d9..8f175990 100644
--- a/server/server_test.go
+++ b/server/server_test.go
@@ -1,4 +1,4 @@
-// Copyright 2012-2019 The NATS Authors
+// Copyright 2012-2020 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -134,8 +134,8 @@ func TestStartProfiler(t *testing.T) {
 }
 
 func TestStartupAndShutdown(t *testing.T) {
-
 	opts := DefaultOptions()
+	opts.NoSystemAccount = true
 
 	s := RunServer(opts)
 	defer s.Shutdown()
diff --git a/server/websocket_test.go b/server/websocket_test.go
index 7be9bd2b..226d7070 100644
--- a/server/websocket_test.go
+++ b/server/websocket_test.go
@@ -985,6 +985,7 @@ func testWSOptions() *Options {
 	opts.DisableShortFirstPing = true
 	opts.Websocket.Host = "127.0.0.1"
 	opts.Websocket.Port = -1
+	opts.NoSystemAccount = true
 	var err error
 	tc := &TLSConfigOpts{
 		CertFile: "./configs/certs/server.pem",
diff --git a/test/configs/auth_seed.conf b/test/configs/auth_seed.conf
index 56228f6c..a75dfc0a 100644
--- a/test/configs/auth_seed.conf
+++ b/test/configs/auth_seed.conf
@@ -13,3 +13,5 @@ cluster {
     timeout: 1
   }
 }
+
+no_sys_acc: true
diff --git a/test/configs/cluster.conf b/test/configs/cluster.conf
index d429d616..a96167af 100644
--- a/test/configs/cluster.conf
+++ b/test/configs/cluster.conf
@@ -20,3 +20,5 @@ cluster {
     nats-route://foo:bar@127.0.0.1:5246
   ]
 }
+
+no_sys_acc: true
diff --git a/test/configs/multi_accounts.conf b/test/configs/multi_accounts.conf
index c3d28ebd..249ba626 100644
--- a/test/configs/multi_accounts.conf
+++ b/test/configs/multi_accounts.conf
@@ -4,7 +4,6 @@ http: 127.0.0.1:8033
 password = "s3cr3t!"
 
 accounts: {
-
    engineering: {
       users = [
         {user: alice, password: $password}
@@ -25,5 +24,6 @@ accounts: {
         {user: paul,  password: $password}
       ]
     }
+}
 
-}
\ No newline at end of file
+no_sys_acc: true
diff --git a/test/configs/new_cluster.conf b/test/configs/new_cluster.conf
index 7cd14d1e..817695a5 100644
--- a/test/configs/new_cluster.conf
+++ b/test/configs/new_cluster.conf
@@ -14,3 +14,5 @@ cluster {
     nats-route://127.0.0.1:5346
   ]
 }
+
+no_sys_acc: true
diff --git a/test/configs/seed.conf b/test/configs/seed.conf
index 64c824b7..cc29c8bc 100644
--- a/test/configs/seed.conf
+++ b/test/configs/seed.conf
@@ -7,3 +7,5 @@ http: 8222
 cluster {
   listen: 127.0.0.1:4248
 }
+
+no_sys_acc: true
diff --git a/test/configs/srv_a.conf b/test/configs/srv_a.conf
index 8dfc4fa4..9bf29532 100644
--- a/test/configs/srv_a.conf
+++ b/test/configs/srv_a.conf
@@ -19,3 +19,5 @@ cluster {
     nats-route://ruser:top_secret@127.0.0.1:5246
   ]
 }
+
+no_sys_acc: true
diff --git a/test/configs/srv_a_perms.conf b/test/configs/srv_a_perms.conf
index 1fa39665..08974fa4 100644
--- a/test/configs/srv_a_perms.conf
+++ b/test/configs/srv_a_perms.conf
@@ -28,3 +28,5 @@ cluster {
     nats-route://ruser:top_secret@127.0.0.1:5246
   ]
 }
+
+no_sys_acc: true
diff --git a/test/configs/srv_a_tls.conf b/test/configs/srv_a_tls.conf
index bdc98968..6a920251 100644
--- a/test/configs/srv_a_tls.conf
+++ b/test/configs/srv_a_tls.conf
@@ -26,3 +26,5 @@ cluster {
     nats-route://127.0.0.1:5246
   ]
 }
+
+no_sys_acc: true
diff --git a/test/configs/srv_b.conf b/test/configs/srv_b.conf
index 33412040..5ad067c3 100644
--- a/test/configs/srv_b.conf
+++ b/test/configs/srv_b.conf
@@ -20,3 +20,5 @@ cluster {
     nats-route://ruser:top_secret@127.0.0.1:5244
   ]
 }
+
+no_sys_acc: true
diff --git a/test/configs/srv_b_tls.conf b/test/configs/srv_b_tls.conf
index 9f2dfb19..61e2784c 100644
--- a/test/configs/srv_b_tls.conf
+++ b/test/configs/srv_b_tls.conf
@@ -26,3 +26,5 @@ cluster {
     nats-route://127.0.0.1:5244
   ]
 }
+
+no_sys_acc: true
diff --git a/test/configs/srv_c.conf b/test/configs/srv_c.conf
index 534ceb8e..b3b8fe5a 100644
--- a/test/configs/srv_c.conf
+++ b/test/configs/srv_c.conf
@@ -19,3 +19,5 @@ cluster {
     nats-route://ruser:top_secret@127.0.0.1:5244
   ]
 }
+
+no_sys_acc: true
diff --git a/test/leafnode_test.go b/test/leafnode_test.go
index d6f61327..7191f7bc 100644
--- a/test/leafnode_test.go
+++ b/test/leafnode_test.go
@@ -48,6 +48,7 @@ func testDefaultOptionsForLeafNodes() *server.Options {
 	o.Port = -1
 	o.LeafNode.Host = o.Host
 	o.LeafNode.Port = -1
+	o.NoSystemAccount = true
 	return &o
 }
 
@@ -69,6 +70,7 @@ func runSolicitLeafServer(lso *server.Options) (*server.Server, *server.Options)
 func runSolicitLeafServerToURL(surl string) (*server.Server, *server.Options) {
 	o := DefaultTestOptions
 	o.Port = -1
+	o.NoSystemAccount = true
 	rurl, _ := url.Parse(surl)
 	o.LeafNode.Remotes = []*server.RemoteLeafOpts{{URLs: []*url.URL{rurl}}}
 	o.LeafNode.ReconnectInterval = 100 * time.Millisecond
diff --git a/test/monitor_test.go b/test/monitor_test.go
index 226c120d..9007aa99 100644
--- a/test/monitor_test.go
+++ b/test/monitor_test.go
@@ -1,4 +1,4 @@
-// Copyright 2012-2019 The NATS Authors
+// Copyright 2012-2020 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -40,7 +40,7 @@ func runMonitorServer() *server.Server {
 	opts.Port = CLIENT_PORT
 	opts.HTTPPort = MONITOR_PORT
 	opts.HTTPHost = "127.0.0.1"
-
+	opts.NoSystemAccount = true
 	return RunServer(&opts)
 }
 
@@ -53,6 +53,7 @@ func runMonitorServerClusteredPair(t *testing.T) (*server.Server, *server.Server
 	opts.HTTPHost = "127.0.0.1"
 	opts.Cluster = server.ClusterOpts{Host: "127.0.0.1", Port: 10223}
 	opts.Routes = server.RoutesFromStr("nats-route://127.0.0.1:10222")
+	opts.NoSystemAccount = true
 
 	s1 := RunServer(&opts)
 
@@ -62,6 +63,7 @@ func runMonitorServerClusteredPair(t *testing.T) (*server.Server, *server.Server
 	opts2.HTTPHost = "127.0.0.1"
 	opts2.Cluster = server.ClusterOpts{Host: "127.0.0.1", Port: 10222}
 	opts2.Routes = server.RoutesFromStr("nats-route://127.0.0.1:10223")
+	opts2.NoSystemAccount = true
 
 	s2 := RunServer(&opts2)
 
@@ -75,6 +77,7 @@ func runMonitorServerNoHTTPPort() *server.Server {
 	opts := DefaultTestOptions
 	opts.Port = CLIENT_PORT
 	opts.HTTPPort = 0
+	opts.NoSystemAccount = true
 
 	return RunServer(&opts)
 }
diff --git a/test/norace_test.go b/test/norace_test.go
index 1a47f041..7c7676bc 100644
--- a/test/norace_test.go
+++ b/test/norace_test.go
@@ -1,4 +1,4 @@
-// Copyright 2019 The NATS Authors
+// Copyright 2019-2020 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -46,6 +46,7 @@ func TestNoRaceRouteSendSubs(t *testing.T) {
 				port: -1
 				%s
 			}
+			no_sys_acc: true
 	`
 	cfa := createConfFile(t, []byte(fmt.Sprintf(template, "")))
 	defer os.Remove(cfa)
diff --git a/test/proto_test.go b/test/proto_test.go
index fd92a965..a03a4446 100644
--- a/test/proto_test.go
+++ b/test/proto_test.go
@@ -1,4 +1,4 @@
-// Copyright 2012-2019 The NATS Authors
+// Copyright 2012-2020 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -27,6 +27,7 @@ func runProtoServer() *server.Server {
 	opts := DefaultTestOptions
 	opts.Port = PROTO_TEST_PORT
 	opts.MaxControlLine = 256
+	opts.NoSystemAccount = true
 	return RunServer(&opts)
 }
 
diff --git a/test/tls_test.go b/test/tls_test.go
index c34c1a9a..6aa4e2b6 100644
--- a/test/tls_test.go
+++ b/test/tls_test.go
@@ -1,4 +1,4 @@
-// Copyright 2015-2019 The NATS Authors
+// Copyright 2015-2020 The NATS Authors
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -556,6 +556,7 @@ func TestTLSRoutesCertificateCNBasedAuth(t *testing.T) {
 	optsA.Cluster.Host = optsA.Host
 	optsA.Cluster.Port = 9935
 	optsA.Routes = server.RoutesFromStr(routeURLs)
+	optsA.NoSystemAccount = true
 	srvA := RunServer(optsA)
 	defer srvA.Shutdown()
 
@@ -564,6 +565,7 @@ func TestTLSRoutesCertificateCNBasedAuth(t *testing.T) {
 	optsB.Cluster.Host = optsB.Host
 	optsB.Cluster.Port = 9936
 	optsB.Routes = server.RoutesFromStr(routeURLs)
+	optsB.NoSystemAccount = true
 	srvB := RunServer(optsB)
 	defer srvB.Shutdown()
 
@@ -572,6 +574,7 @@ func TestTLSRoutesCertificateCNBasedAuth(t *testing.T) {
 	optsC.Cluster.Host = optsC.Host
 	optsC.Cluster.Port = 9937
 	optsC.Routes = server.RoutesFromStr(routeURLs)
+	optsC.NoSystemAccount = true
 	srvC := RunServer(optsC)
 	defer srvC.Shutdown()
 
@@ -1280,7 +1283,7 @@ func TestTLSClientSVIDAuth(t *testing.T) {
 
 				authorization {
 				  users = [
-				    { 
+				    {
                                       user = "spiffe://localhost/my-nats-service/user-a"
                                     }
 				  ]
@@ -1298,12 +1301,12 @@ func TestTLSClientSVIDAuth(t *testing.T) {
 
 				authorization {
 				  users = [
-				    { 
+				    {
                                       user = "spiffe://localhost/my-nats-service/user-a"
                                     },
-				    { 
+				    {
                                       user = "spiffe://localhost/my-nats-service/user-b"
-                                      permissions = { subscribe = { deny = ">" }} 
+                                      permissions = { subscribe = { deny = ">" }}
                                     }
 				  ]
 				}
@@ -1320,8 +1323,8 @@ func TestTLSClientSVIDAuth(t *testing.T) {
 
 				authorization {
 				  users = [
-				    { 
-                                      user = "O=SPIRE,C=US" 
+				    {
+                                      user = "O=SPIRE,C=US"
                                     }
 				  ]
 				}
@@ -1338,7 +1341,7 @@ func TestTLSClientSVIDAuth(t *testing.T) {
 
 				authorization {
 				  users = [
-				    { 
+				    {
                                       user = "spiffe://localhost/my-nats-service/user-c"
                                     }
 				  ]