TMA-GITLAB-1.3.11
Ensure an organization provides SSH certificates
Descrição
As an organization, become an SSH Certificate Authority and provide SSH keys for accessing repositories. There are two ways for remotely working with Source Code Management: via HTTPS, which requires authentication by user/password, or via SSH, which requires the use of SSH keys. SSH authentication is better in terms of security; key creation and distribution, however, must be done in a secure manner. This can be accomplished by implementing SSH certificates, which are used to validate the server's identity. A developer will not be able to connect to a Git server if its key cannot be verified by the SSH Certificate Authority (CA) server. As an organization, one can verify the SSH certificate signature used to authenticate if a CA is defined and used. This ensures that only verified developers can access organization repositories, as their SSH key will be the only one signed by the CA...
Como é verificado
Método de auditoria: Revisão manual
Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.
GitLab allows you to restrict the allowed SSH key technology as well as specify the minimum key length for each technology: 1. On the left sidebar, at the bottom, select Admin Area. 2. Select Settings > General . 3. Expand Visibility and access controls 4. If a restriction is imposed on any key type, users cannot upload new SSH keys that don’t meet the requirement. Any existing keys that don’t meet it are disabled but not removed and users cannot pull or push code using them.
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
If you do not have an existing SSH key pair, generate a new one: 1. Open a terminal. 2. Run ssh-keygen -t followed by the key type and an optional comment. This comment is included in the .pub file that’s created. 3. Press Enter. 4. Accept the suggested filename and directory, unless you are generating a deploy key or want to save in a specific directory where you store other keys. 5. Specify a passphrase 6. A confirmation is displayed, including information about where your files are stored. A public and private key are generated. 7. Add the public SSH key to your GitLab account and keep the private key secure.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- devsecopsgitlabssh
- Referência
- CIS GitLab Benchmark v1.0.1 - 1.3.11 Ensure an organization provides SSH certificates