| stage | group | description | info |
|---|---|---|---|
Govern |
Authentication |
SSH key limits, 2FA, tokens, hardening. |
To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments |
DETAILS: Tier: Free, Premium, Ultimate Offering: GitLab.com, Self-managed, GitLab Dedicated
This section covers some general information and recommendations regarding the platform.
- How passwords and OAuth tokens are stored.
- How passwords for users created through integrated authentication are generated.
- How we manage the CRIME vulnerability.
- Secrets for third-party integrations should be rotated regularly.
The Hardening Guide contains additional general recommendations that can be implemented for hardening an install.
Generally, running an antivirus software on the GitLab host is not recommended.
However, if you must use one, all of the location of GitLab on the system should be excluded from scanning as it could be quarantined as a false positive.
Specifically, you should exclude the following GitLab directories from scanning:
/var/opt/gitlab/etc/gitlab//var/log/gitlab//opt/gitlab/
You can find all those directories listed in the Linux package configuration documentation.
- Review authentication options.
- Configure password length limits.
- Restrict SSH key technologies and require minimum key lengths.
- Restrict account creation with sign up restrictions.
- Send email confirmation on sign-up
- Enforce two-factor authentication to require users to enable two-factor authentication.
- Restrict logins from multiple IPs.
- How to reset a user password.
- How to unlock a locked user.
- Information exclusivity.
- Protecting and removing user file uploads.
- Proxying linked images for user privacy.
- Review GitLab token type and usages.
- How to configure rate limits improve security and availability.
- How to filter outbound webhook requests.
- How to configure import and export limits and timeouts.
- Review Runner security considerations and recommendations.
- Review CI/CD variables security considerations.
- Review pipeline security for usage and protection of secrets in CI/CD Pipelines.
Self-managed GitLab customers and administrators are responsible for the security of their underlying hosts, and for keeping GitLab itself up to date. It is important to regularly patch GitLab, patch your operating system and its software, and harden your hosts in accordance with vendor guidance.