diff options
author | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2013-10-01 12:14:05 +0400 |
---|---|---|
committer | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2013-10-01 12:14:05 +0400 |
commit | ac6180bcb04d3f7486b87bf1a950e8250c6e27a5 (patch) | |
tree | 5143ef5d9da3628c35ac2e5fe520d9e118abe51d /doc | |
parent | 9ffabc6d7ed0c71d133a29671b50795fb621522c (diff) | |
parent | 775aa5ba7ce5ef335bcae81bbc2bf8b7b1321303 (diff) |
Merge branch 'rack_attack' of /home/git/repositories/gitlab/gitlabhq
Diffstat (limited to 'doc')
-rw-r--r-- | doc/install/installation.md | 7 | ||||
-rw-r--r-- | doc/security/rack_attack.md | 19 | ||||
-rw-r--r-- | doc/update/6.1-to-6.2.md | 100 |
3 files changed, 126 insertions, 0 deletions
diff --git a/doc/install/installation.md b/doc/install/installation.md index 71a587d2ee3..03ea5fbb28f 100644 --- a/doc/install/installation.md +++ b/doc/install/installation.md @@ -195,6 +195,13 @@ You can change `6-1-stable` to `master` if you want the *bleeding edge* version, # Ex. change amount of workers to 3 for 2GB RAM server sudo -u git -H editor config/unicorn.rb + # Copy the example Rack attack config + sudo -u git -H cp config/initializers/rack_attack.rb.example config/initializers/rack_attack.rb + + # Enable rack attack middleware + # Find and uncomment the line 'config.middleware.use Rack::Attack' + sudo -u git -H editor config/application.rb + # Configure Git global settings for git user, useful when editing via web # Edit user.email according to what is set in gitlab.yml sudo -u git -H git config --global user.name "GitLab" diff --git a/doc/security/rack_attack.md b/doc/security/rack_attack.md new file mode 100644 index 00000000000..a0d02b1650f --- /dev/null +++ b/doc/security/rack_attack.md @@ -0,0 +1,19 @@ +To prevent abusive clients doing damage GitLab uses rack-attack gem. +If you installed or upgraded GitLab by following the official guides this should be enabled by default. +If you are missing `config/initializers/rack_attack.rb` the following steps need to be taken in order to enable protection for your GitLab instance: + +1. In config/application.rb find and uncomment the following line: + config.middleware.use Rack::Attack +2. Rename config/initializers/rack_attack.rb.example to config/initializers/rack_attack.rb +3. Review the paths_to_be_protected and add any other path you need protecting +4. Restart GitLab instance + +By default, user sign-in, user sign-up(if enabled) and user password reset is limited to 6 requests per minute. +After trying for 6 times, client will have to wait for the next minute to be able to try again. +These settings can be found in `config/initializers/rack_attack.rb` + +If you want more restrictive/relaxed throttle rule change the `limit` or `period` values. For example, more relaxed throttle rule will be if you set limit: 3 and period: 1.second(this will allow 3 requests per second). You can also add other paths to the protected list by adding to `paths_to_be_protected` variable. If you change any of these settings do not forget to restart your GitLab instance. + +In case you find throttling is not enough to protect you against abusive clients, rack-attack gem offers IP whitelisting, blacklisting, Fail2ban style filter and tracking. + +For more information on how to use these options check out [rack-attack README](https://github.com/kickstarter/rack-attack/blob/master/README.md).
\ No newline at end of file diff --git a/doc/update/6.1-to-6.2.md b/doc/update/6.1-to-6.2.md new file mode 100644 index 00000000000..747b4860796 --- /dev/null +++ b/doc/update/6.1-to-6.2.md @@ -0,0 +1,100 @@ +# From 6.1 to 6.2 + +# You should update to 6.1 before installing 6.2 so all the necessary conversions are run. + +### 0. Backup + +It's useful to make a backup just in case things go south: +(With MySQL, this may require granting "LOCK TABLES" privileges to the GitLab user on the database version) + +```bash +cd /home/git/gitlab +sudo -u git -H RAILS_ENV=production bundle exec rake gitlab:backup:create +``` + +### 1. Stop server + + sudo service gitlab stop + +### 2. Get latest code + +```bash +cd /home/git/gitlab +sudo -u git -H git fetch +sudo -u git -H git checkout 6-2-stable +``` + +### 3. Update gitlab-shell + +```bash +cd /home/git/gitlab-shell +sudo -u git -H git fetch +sudo -u git -H git checkout v1.7.1 +``` + +### 4. Install libs, migrations, etc. + +```bash +cd /home/git/gitlab + +# MySQL +sudo -u git -H bundle install --without development test postgres --deployment + +#PostgreSQL +sudo -u git -H bundle install --without development test mysql --deployment + + +sudo -u git -H bundle exec rake db:migrate RAILS_ENV=production +sudo -u git -H bundle exec rake migrate_iids RAILS_ENV=production +sudo -u git -H bundle exec rake assets:clean RAILS_ENV=production +sudo -u git -H bundle exec rake assets:precompile RAILS_ENV=production +sudo -u git -H bundle exec rake cache:clear RAILS_ENV=production +``` + +### 5. Update config files + +* Make `/home/git/gitlab/config/gitlab.yml` same as https://github.com/gitlabhq/gitlabhq/blob/6-2-stable/config/gitlab.yml.example but with your settings. +* Make `/home/git/gitlab/config/unicorn.rb` same as https://github.com/gitlabhq/gitlabhq/blob/6-2-stable/config/unicorn.rb.example but with your settings. +* Copy rack attack middleware config +```bash +sudo -u git -H cp config/initializers/rack_attack.rb.example config/initializers/rack_attack.rb +``` +* Uncomment `config.middleware.use Rack::Attack` in `/home/git/gitlab/config/application.rb` + +### 6. Update Init script + +```bash +sudo rm /etc/init.d/gitlab +sudo curl --output /etc/init.d/gitlab https://raw.github.com/gitlabhq/gitlabhq/6-2-stable/lib/support/init.d/gitlab +sudo chmod +x /etc/init.d/gitlab +``` + +### 7. Start application + + sudo service gitlab start + sudo service nginx restart + +### 8. Check application status + +Check if GitLab and its environment are configured correctly: + + sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production + +To make sure you didn't miss anything run a more thorough check with: + + sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production + +If all items are green, then congratulations upgrade complete! + +## Things went south? Revert to previous version (6.1) + +### 1. Revert the code to the previous version +Follow the [`upgrade guide from 6.0 to 6.1`](6.0-to-6.1.md), except for the database migration +(The backup is already migrated to the previous version) + +### 2. Restore from the backup: + +```bash +cd /home/git/gitlab +sudo -u git -H RAILS_ENV=production bundle exec rake gitlab:backup:restore +``` |