[go: up one dir, main page]

Skip to content

Add support to "from" option in authorized_keys file

Proposal

As many users, sometimes technical, can connect to GitLab using SSH keys, would be useful to restrict the source hosts. A "from" option can be used in authorized_keys entries that is inteded to achieve this goal, but it is unsupported (i.e. when someone paste the public SSH key with "from" option in "Add SSH key" form in user profile UI, the key is wrongly parsed and refused).

Intended users

GitLab administrators

User experience goal

An user can restrict the source hosts from which the authentication is performed.

Proposal

Add the support to "from" option when parsing public SSH keys in UI form.

Further details

Permissions and Security

Documentation

https://www.ssh.com/ssh/authorized_keys/openssh#from=%22pattern-list%22

Availability & Testing

What does success look like, and how can we measure that?

A success would be the ability to deny the connection done form hosts not listed in key's "from" option. On the other hand, the connection should be allowed from hostnames and/or IPs listed.

What is the type of buyer?

Is this a cross-stage feature?

Links / references