Skip to content

Enforce SSH key expiration by default

Tan Le requested to merge 320970-enforce-ssh-key-expiration-by-default into master

What does this MR do?

This change sets the default value of enforce_ssh_key_expiration on the application_settings table to be true. We also update existing settings to be true. Users will no longer be able to use expired SSH keys to authenticate to GitLab.

🐘 Databases

Migrate

== 20210531070452 DefaultEnforceSshKeyExpiration: migrating ===================                                        
-- change_column_default(:application_settings, :enforce_ssh_key_expiration, {:from=>false, :to=>true})                         
   -> 0.0526s                                                                                                                   
== 20210531070452 DefaultEnforceSshKeyExpiration: migrated (0.0527s) ==========                                                 
                                                                                                                                
== 20210531071107 EnableEnforceSshKeyExpiration: migrating ====================                                    
== 20210531071107 EnableEnforceSshKeyExpiration: migrated (0.0723s) ===========     

Rollback

== 20210531071107 EnableEnforceSshKeyExpiration: reverting ====================
== 20210531071107 EnableEnforceSshKeyExpiration: reverted (0.0000s) ===========

== 20210531070452 DefaultEnforceSshKeyExpiration: reverting ===================
-- change_column_default(:application_settings, :enforce_ssh_key_expiration, {:from=>true, :to=>false})
   -> 0.0523s
== 20210531070452 DefaultEnforceSshKeyExpiration: reverted (0.0595s) ==========

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

Does this MR contain changes to processing or storing of credentials or tokens, authorization and authentication methods or other items described in the security review guidelines? If not, then delete this Security section.

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Related to #320970 (closed) and #331928 (closed)

Edited by Tan Le

Merge request reports

Loading