TMA-GITLAB-1.3.11

Ensure an organization provides SSH certificates

高レベル 2手動レビューgitlab

説明

As an organization, become an SSH Certificate Authority and provide SSH keys for accessing repositories. There are two ways for remotely working with Source Code Management: via HTTPS, which requires authentication by user/password, or via SSH, which requires the use of SSH keys. SSH authentication is better in terms of security; key creation and distribution, however, must be done in a secure manner. This can be accomplished by implementing SSH certificates, which are used to validate the server's identity. A developer will not be able to connect to a Git server if its key cannot be verified by the SSH Certificate Authority (CA) server. As an organization, one can verify the SSH certificate signature used to authenticate if a CA is defined and used. This ensures that only verified developers can access organization repositories, as their SSH key will be the only one signed by the CA...

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

GitLab allows you to restrict the allowed SSH key technology as well as specify the minimum key length for each technology: 1. On the left sidebar, at the bottom, select Admin Area. 2. Select Settings > General . 3. Expand Visibility and access controls 4. If a restriction is imposed on any key type, users cannot upload new SSH keys that don’t meet the requirement. Any existing keys that don’t meet it are disabled but not removed and users cannot pull or push code using them.

修正方法

修正方法: ガイダンスまたは IaC パッチ

If you do not have an existing SSH key pair, generate a new one: 1. Open a terminal. 2. Run ssh-keygen -t followed by the key type and an optional comment. This comment is included in the .pub file that’s created. 3. Press Enter. 4. Accept the suggested filename and directory, unless you are generating a deploy key or want to save in a specific directory where you store other keys. 5. Specify a passphrase 6. A confirmation is displayed, including information about where your files are stored. A public and private key are generated. 7. Add the public SSH key to your GitLab account and keep the private key secure.

プロパティ

オペレーティングシステム: すべて
タグ: devsecopsgitlabssh
参照: CIS GitLab Benchmark v1.0.1 - 1.3.11 Ensure an organization provides SSH certificates