Skip to content

Commit 7726264

Browse files
nicholasdillenicholasdille
committed
Fixes after 20231123
1 parent 1c675f4 commit 7726264

File tree

6 files changed

+76
-29
lines changed

6 files changed

+76
-29
lines changed

‎150_gitlab/030_authentication/slides.md

Lines changed: 59 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ Project Deploy SSH Key (read-write) [<i class="fa-solid fa-arrow-up-right-from-s
5555

5656
---
5757

58-
## Caveats
58+
## Caveats 1/
5959

6060
### Token creation can be tricky
6161

@@ -76,3 +76,61 @@ Role: Developer
7676
Scope: `read_repository`
7777

7878
User can pull but not push
79+
80+
---
81+
82+
## Caveats 2/2
83+
84+
Deploy keys belong to a user who can be blocked <i class="fa-solid fa-face-scream"></i> [gitlab-org/gitlab#35779](https://gitlab.com/gitlab-org/gitlab/-/issues/35779)
85+
86+
Find and fix deploy keys using Ruby code in rals console [](https://docs.gitlab.com/ee/user/project/deploy_keys/#identify-deploy-keys-associated-with-non-member-and-blocked-users)
87+
88+
```ruby
89+
DeployKeysProject.with_write_access.find_each do |deploy_key_mapping|
90+
project = deploy_key_mapping.project
91+
deploy_key = deploy_key_mapping.deploy_key
92+
user = deploy_key.user
93+
94+
access_checker = Gitlab::DeployKeyAccess.new(deploy_key, container: project)
95+
can_push = access_checker.can_do_action?(:push_code)
96+
can_push_to_default = access_checker.can_push_for_ref?(project.repository.root_ref)
97+
98+
next if access_checker.allowed? && can_push && can_push_to_default
99+
100+
puts "Deploy key: #{deploy_key.id}, Project: #{project.full_path}, Can push?: " + (can_push ? 'YES' : 'NO') +
101+
", Can push to default branch #{project.repository.root_ref}?: " + (can_push_to_default ? 'YES' : 'NO') +
102+
", User: #{user.username}, User ID: #{user.id}, User state: #{user.state}"
103+
end
104+
```
105+
106+
---
107+
108+
## Comparison
109+
110+
| | Password | Personal Access Token | Personal SSH Key | Group Access Token | Group Deploy Token | Project Access Token | Project Deploy Token | Project SSH Key (0) |
111+
|-|-|-|-|-|-|-|-|-|
112+
| Access to Web UI | Yes | No | No | No | No | No | No | No |
113+
| Access to API | Indirect (1) | Yes | No | Yes (2) | No | Yes (3) | No | No |
114+
| Read git repository | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
115+
| Write git repository | Yes | Yes | Yes | Yes | No | Yes | No | No |
116+
| Access CI variables | Yes | Yes (4) | No | Yes (4) | No | Yes (4) | No | No |
117+
| Access scope | User | User | User | Group | Group | Project | Project | Project |
118+
| Credential reuse (5) | Possible | No | Possible | No | No | No | No | Possible |
119+
| Impact of security incident | High | High | High | Medium | Medium | Low | Low | Medium |
120+
| Recommendation | No | No | No | Limited (6) | Limited (6) | Yes | Yes | Limited (6) |
121+
122+
<!-- .element: style="font-size: large;" -->
123+
124+
(0) XXX
125+
126+
(1) Username and password can be used to retrieve a personal access token
127+
128+
(2) Group only
129+
130+
(3) Project only
131+
132+
(4) API only
133+
134+
(5) Can be used for multiple accounts and on multiple systems
135+
136+
(6) Acceptable for automation to avoid many project credentials

‎150_gitlab/090_maintenance/slides.md

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,12 @@
1212

1313
### Messages
1414

15-
Show a banner announcing maintenance work
15+
Show a banner announcing maintenance work [<i class="fa-solid fa-arrow-up-right-from-square"></i>](https://docs.gitlab.com/ee/administration/broadcast_messages.html)
1616

1717
Configure under Menu <i class="fa-regular fa-arrow-right"></i> Admin <i class="fa-regular fa-arrow-right"></i> Messages
1818

19+
Can also show up in git response
20+
1921
### Maintenance Mode (Premium feature)
2022

2123
Switch GitLab into read-only mode [<i class="fa-solid fa-arrow-up-right-from-square"></i>](https://docs.gitlab.com/ee/administration/maintenance_mode/)
@@ -26,14 +28,9 @@ Switch GitLab into read-only mode [<i class="fa-solid fa-arrow-up-right-from-squ
2628

2729
<i class="fa-brands fa-git-alt fa-4x" style="float: right;"></i>
2830

29-
Configure under Menu <i class="fa-regular fa-arrow-right"></i> Admin <i class="fa-regular fa-arrow-right"></i> Settings <i class="fa-regular fa-arrow-right"></i> Repository
30-
31-
### Settings
32-
33-
Runs `git fsck` to find silent disk corruption
34-
35-
Incremental `git repack` after 10 pushes
36-
37-
Full `git repack` after 50 pushes
31+
Configure under Menu <i class="fa-regular fa-arrow-right"></i> Admin <i class="fa-regular fa-arrow-right"></i> Settings <i class="fa-regular fa-arrow-right"></i> Repository <i class="fa-regular fa-arrow-right"></i> Repository Maintenance
3832

39-
`git gc` after 200 pushes
33+
Regular execution of...
34+
- `git fsck`
35+
- `git repack` (incremental and full)
36+
- `git gc`

‎150_gitlab/140_troubleshooting/slides.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,12 @@ Debug SSH connection and authentication:
6969
ssh -Tvvv -i id_rsa git@gitlab.<DOMAIN>
7070
```
7171

72+
Find user for given SSH key fingerprint:
73+
74+
```bash
75+
curl --silent --header "Private-Token: admin-private-token" https://gitlab.haufedev.systems/api/v4/keys?fingerprint=d0:6d:2e:bb:fb:27:f1:6e:80:6c:16:b2:be:c6:d8:00 | jq
76+
```
77+
7278
---
7379

7480
## Tokens

‎150_gitlab/160_runner/slides.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ New default in 16.0 (May 2023)
3232

3333
Enforcement in 16.6 (November 2023)
3434

35-
Removal of old runne registration in 17.0 (May 2024)
35+
Removal of old runner registration in 17.0 (May 2024)
3636

3737
### Old process
3838

‎2023-11-23_heise-GitLab-Ops.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@
167167

168168
~~2023-11-23: Workshop [GitLab Ops](https://heise-academy.de/schulungen/einfuehrung-in-gitlab) (1 day)~~
169169

170-
2023-11-30 / 2023-11-07: Workshop [GitLab CI](https://heise-academy.de/schulungen/cicd-gitlab) (2 days)
170+
2023-11-30 / 2023-12-07: Workshop [GitLab CI](https://heise-academy.de/schulungen/cicd-gitlab) (2 days)
171171
</textarea></section>
172172
</div>
173173
</div>

‎2023-11-23_heise-GitLab-Ops.md

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,6 @@
11
# GitLab Ops
22

3-
Neue UI 16
4-
5-
Tabelle für Tokens
6-
7-
User Preferences - Auth Log
8-
9-
Vorinstallation glab
10-
11-
Messages in git response?!
12-
https://docs.gitlab.com/ee/administration/broadcast_messages.html
13-
143
Repo housekeeping fewer options
15-
16-
runne
17-
18-
2023-11-07
4+
https://docs.gitlab.com/ee/administration/housekeeping.html
195

206
https://micro.dev/

0 commit comments

Comments
 (0)