Add settings for minimum key strength and allowed key type
Originally opened at !5552 (closed) by @electrickite.
What does this MR do?
This merge request adds three new application settings:
-
minimum_rsa_bits
: The minimum allowed bit length of an uploaded RSA key -
minimum_ecdsa_bits
: The minimum allowed curve size (in bits) of an uploaded ECDSA key -
allowed_key_types
: The SSH key types accepted by the application (RSA, DSA, or ECDSA)
To support these settings, it adds validations to the Key
model to check length/type and three fields to the application settings page to allow an administrator to configure them. API support is also added.
Are there points in the code the reviewer needs to double check?
Based on the validations in the Key
model, it looks like Gitlab currently accepts only RSA, DSA, and ECDSA keys. This assumption should be verified.
Why was this MR needed?
"The admin does not have control over the key length or type for the ssh keys. This is something that could become a problem as the brute force cracking of keys becomes less difficult."
ssh-keygen
allows users to create RSA keys with as few as 768 bits, which falls well below recommendations from certain standards groups (such as the US NIST). Some organizations deploying Gitlab will need to enforce minimum key strength, either to satisfy internal security policy or for regulatory compliance.
Similarly, certain standards groups recommend using RSA or ECDSA over the older DSA and administrators may need to limit the allowed SSH key algorithms.
Screenshots
Application settings screen
SSH key technology is not allowed error
SSH key length is too small
Does this MR meet the acceptance criteria?
-
CHANGELOG entry added -
Documentation created/updated -
API support added - Tests
-
Added for this feature/bug -
Added a feature spec -
All builds are passing
-
-
Conform by the style guides -
Branch has no merge conflicts with master
(if you do - rebase it please) -
Squashed related commits together
Closes #17849 (closed)