diff options
| author | Achilleas Pipinellis <axilleas@axilleas.me> | 2015-12-25 14:21:14 +0200 |
|---|---|---|
| committer | Achilleas Pipinellis <axilleas@axilleas.me> | 2015-12-25 14:21:14 +0200 |
| commit | 05f8c585f71256bf07c83efba2beb516efd72c4c (patch) | |
| tree | 5f5ea48835898657c4fd6defd8527ad78ad4547c /doc/security | |
| parent | a3de46654b2fe0f02995913a771e6423bb584d64 (diff) | |
| parent | ed777c7bcc990e5e3ff9f8e0d28a1e23af44d8f1 (diff) | |
| download | gitlab-ce-05f8c585f71256bf07c83efba2beb516efd72c4c.tar.gz | |
Merge branch 'master' into adding_crime_security
Diffstat (limited to 'doc/security')
| -rw-r--r-- | doc/security/README.md | 1 | ||||
| -rw-r--r-- | doc/security/two_factor_authentication.md | 38 |
2 files changed, 39 insertions, 0 deletions
diff --git a/doc/security/README.md b/doc/security/README.md index 7df7cef6aa5..f34c792d005 100644 --- a/doc/security/README.md +++ b/doc/security/README.md @@ -7,3 +7,4 @@ - [Reset your root password](reset_root_password.md) - [User File Uploads](user_file_uploads.md) - [How we manage the CRIME vulnerability](crime_vulnerability.md) +- [Enforce Two-Factor authentication](two_factor_authentication.md) diff --git a/doc/security/two_factor_authentication.md b/doc/security/two_factor_authentication.md new file mode 100644 index 00000000000..4e25a1fdc3f --- /dev/null +++ b/doc/security/two_factor_authentication.md @@ -0,0 +1,38 @@ +# Enforce Two-factor Authentication (2FA) + +Two-factor Authentication (2FA) provides an additional level of security to your +users' GitLab account. Once enabled, in addition to supplying their username and +password to login, they'll be prompted for a code generated by an application on +their phone. + +You can read more about it here: +[Two-factor Authentication (2FA)](doc/profile/two_factor_authentication.md) + +## Enabling 2FA + +Users on GitLab, can enable it without any admin's intervention. If you want to +enforce everyone to setup 2FA, you can choose from two different ways: + + 1. Enforce on next login + 2. Suggest on next login, but allow a grace period before enforcing. + +In the Admin area under **Settings** (`/admin/application_settings`), look for +the "Sign-in Restrictions" area, where you can configure both. + +If you want 2FA enforcement to take effect on next login, change the grace +period to `0` + +## Disabling 2FA for everyone + +There may be some special situations where you want to disable 2FA for everyone +even when forced 2FA is disabled. There is a rake task for that: + +``` +# use this command if you've installed GitLab with the Omnibus package +sudo gitlab-rake gitlab:two_factor:disable_for_all_users + +# if you've installed GitLab from source +sudo -u git -H bundle exec rake gitlab:two_factor:disable_for_all_users RAILS_ENV=production +``` + +**IMPORTANT: this is a permanent and irreversible action. Users will have to reactivate 2FA from scratch if they want to use it again.** |