Ensure inactive repositories are reviewed and archived periodically

低级别 1人工审核gitlab

说明

Track inactive repositories and remove them periodically. Inactive repositories (i.e., no new changes introduced for a long period of time) can enlarge the surface of a potential attack or data leak. These repositories are more likely to be improperly managed, and thus could possibly be accessed by a large number of users in an organization.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Perform the following to ensure that all the projects in the organization are active. For each group: - Navigate to the group homepage. - Expand any sub-groups. - For each project, review the updated date and ensure it has been updated within the last 6 months.

修复方式

修复方法: 操作指南或基础设施补丁

Perform the following to remediate the presence of inactive projects. For each inactive project identified during the audit: - Navigate to the project homepage. - In the sidebar, select Settings > General. - In the 'Advanced' section, select 'Expand'. - Select 'Archive project'. - Read the warning. - Select 'Archive project'. To automate the deletion of inactive projects, perform the following steps as an Administrator: - On the left sidebar, at the bottom, select Admin Area. - Select Settings > Repository. - Expand Repository maintenance. - In the Inactive project deletion section, select Delete inactive projects. - Configure the settings. o The warning email is sent to users who have the Owner and Maintainer role for the inactive project. o The email duration must be less than the Delete project after duration. - Select Save changes.

属性

操作系统: 任意
标签: devsecopsgitlab
参考: CIS GitLab Benchmark v1.0.1 - 1.2.7 Ensure inactive repositories are reviewed and archived periodically