summaryrefslogtreecommitdiff
path: root/doc/security
diff options
context:
space:
mode:
authorAchilleas Pipinellis <axilleas@axilleas.me>2015-12-25 14:21:14 +0200
committerAchilleas Pipinellis <axilleas@axilleas.me>2015-12-25 14:21:14 +0200
commit05f8c585f71256bf07c83efba2beb516efd72c4c (patch)
tree5f5ea48835898657c4fd6defd8527ad78ad4547c /doc/security
parenta3de46654b2fe0f02995913a771e6423bb584d64 (diff)
parented777c7bcc990e5e3ff9f8e0d28a1e23af44d8f1 (diff)
downloadgitlab-ce-05f8c585f71256bf07c83efba2beb516efd72c4c.tar.gz
Merge branch 'master' into adding_crime_security
Diffstat (limited to 'doc/security')
-rw-r--r--doc/security/README.md1
-rw-r--r--doc/security/two_factor_authentication.md38
2 files changed, 39 insertions, 0 deletions
diff --git a/doc/security/README.md b/doc/security/README.md
index 7df7cef6aa5..f34c792d005 100644
--- a/doc/security/README.md
+++ b/doc/security/README.md
@@ -7,3 +7,4 @@
- [Reset your root password](reset_root_password.md)
- [User File Uploads](user_file_uploads.md)
- [How we manage the CRIME vulnerability](crime_vulnerability.md)
+- [Enforce Two-Factor authentication](two_factor_authentication.md)
diff --git a/doc/security/two_factor_authentication.md b/doc/security/two_factor_authentication.md
new file mode 100644
index 00000000000..4e25a1fdc3f
--- /dev/null
+++ b/doc/security/two_factor_authentication.md
@@ -0,0 +1,38 @@
+# Enforce Two-factor Authentication (2FA)
+
+Two-factor Authentication (2FA) provides an additional level of security to your
+users' GitLab account. Once enabled, in addition to supplying their username and
+password to login, they'll be prompted for a code generated by an application on
+their phone.
+
+You can read more about it here:
+[Two-factor Authentication (2FA)](doc/profile/two_factor_authentication.md)
+
+## Enabling 2FA
+
+Users on GitLab, can enable it without any admin's intervention. If you want to
+enforce everyone to setup 2FA, you can choose from two different ways:
+
+ 1. Enforce on next login
+ 2. Suggest on next login, but allow a grace period before enforcing.
+
+In the Admin area under **Settings** (`/admin/application_settings`), look for
+the "Sign-in Restrictions" area, where you can configure both.
+
+If you want 2FA enforcement to take effect on next login, change the grace
+period to `0`
+
+## Disabling 2FA for everyone
+
+There may be some special situations where you want to disable 2FA for everyone
+even when forced 2FA is disabled. There is a rake task for that:
+
+```
+# use this command if you've installed GitLab with the Omnibus package
+sudo gitlab-rake gitlab:two_factor:disable_for_all_users
+
+# if you've installed GitLab from source
+sudo -u git -H bundle exec rake gitlab:two_factor:disable_for_all_users RAILS_ENV=production
+```
+
+**IMPORTANT: this is a permanent and irreversible action. Users will have to reactivate 2FA from scratch if they want to use it again.**