TMA-GITLAB-1.3.11

Ensure an organization provides SSH certificates

높음레벨 2수동 검토gitlab

설명

As an organization, become an SSH Certificate Authority and provide SSH keys for accessing repositories. There are two ways for remotely working with Source Code Management: via HTTPS, which requires authentication by user/password, or via SSH, which requires the use of SSH keys. SSH authentication is better in terms of security; key creation and distribution, however, must be done in a secure manner. This can be accomplished by implementing SSH certificates, which are used to validate the server's identity. A developer will not be able to connect to a Git server if its key cannot be verified by the SSH Certificate Authority (CA) server. As an organization, one can verify the SSH certificate signature used to authenticate if a CA is defined and used. This ensures that only verified developers can access organization repositories, as their SSH key will be the only one signed by the CA...

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

GitLab allows you to restrict the allowed SSH key technology as well as specify the minimum key length for each technology: 1. On the left sidebar, at the bottom, select Admin Area. 2. Select Settings > General . 3. Expand Visibility and access controls 4. If a restriction is imposed on any key type, users cannot upload new SSH keys that don’t meet the requirement. Any existing keys that don’t meet it are disabled but not removed and users cannot pull or push code using them.

조치 방법

조치 방식: 가이드 또는 인프라 패치

If you do not have an existing SSH key pair, generate a new one: 1. Open a terminal. 2. Run ssh-keygen -t followed by the key type and an optional comment. This comment is included in the .pub file that’s created. 3. Press Enter. 4. Accept the suggested filename and directory, unless you are generating a deploy key or want to save in a specific directory where you store other keys. 5. Specify a passphrase 6. A confirmation is displayed, including information about where your files are stored. A public and private key are generated. 7. Add the public SSH key to your GitLab account and keep the private key secure.

속성

운영 체제: 모두
태그: devsecopsgitlabssh
참고 자료: CIS GitLab Benchmark v1.0.1 - 1.3.11 Ensure an organization provides SSH certificates