2020-03-16 21:09:21 +00:00
|
|
|
---
|
|
|
|
type: reference, howto
|
|
|
|
---
|
|
|
|
|
2020-04-06 06:09:19 +00:00
|
|
|
# Offline environments
|
2020-03-16 21:09:21 +00:00
|
|
|
|
2020-04-06 06:09:19 +00:00
|
|
|
It's possible to run most of the GitLab security scanners when not connected to the internet.
|
2020-03-16 21:09:21 +00:00
|
|
|
|
2020-04-06 06:09:19 +00:00
|
|
|
This document describes how to operate Secure Categories (that is, scanner types) in an offline
|
|
|
|
environment. These instructions also apply to self-managed installations that are secured, have
|
|
|
|
security policies (for example, firewall policies), or are otherwise restricted from accessing the
|
|
|
|
full internet. GitLab refers to these environments as _offline environments_. Other common names
|
|
|
|
include:
|
2020-03-16 21:09:21 +00:00
|
|
|
|
2020-04-01 00:08:09 +00:00
|
|
|
- Air-gapped environments
|
|
|
|
- Limited connectivity environments
|
|
|
|
- Local area network (LAN) environments
|
|
|
|
- Intranet environments
|
|
|
|
|
|
|
|
These environments have physical barriers or security policies (for example, firewalls) that prevent
|
|
|
|
or limit internet access. These instructions are designed for physically disconnected networks, but
|
|
|
|
can also be followed in these other use cases.
|
|
|
|
|
2020-04-06 06:09:19 +00:00
|
|
|
## Defining offline environments
|
2020-03-27 18:07:48 +00:00
|
|
|
|
2020-04-06 06:09:19 +00:00
|
|
|
In an offline environment, the GitLab instance can be one or more servers and services that can
|
|
|
|
communicate on a local network, but with no or very restricted access to the internet. Assume
|
|
|
|
anything within the GitLab instance and supporting infrastructure (for example, a private Maven
|
|
|
|
repository) can be accessed through a local network connection. Assume any files from the internet
|
|
|
|
must come in through physical media (USB drive, hard drive, writeable DVD, etc.).
|
2020-03-16 21:09:21 +00:00
|
|
|
|
2020-03-27 18:07:48 +00:00
|
|
|
## Overview
|
2020-03-16 21:09:21 +00:00
|
|
|
|
|
|
|
GitLab scanners generally will connect to the internet to download the
|
|
|
|
latest sets of signatures, rules, and patches. A few extra steps are necessary
|
2020-03-27 18:07:48 +00:00
|
|
|
to configure the tools to function properly by using resources available on your local network.
|
2020-03-16 21:09:21 +00:00
|
|
|
|
|
|
|
### Container registries and package repositories
|
|
|
|
|
2020-03-27 18:07:48 +00:00
|
|
|
At a high-level, the security analyzers are delivered as Docker images and
|
|
|
|
may leverage various package repositories. When you run a job on
|
2020-03-16 21:09:21 +00:00
|
|
|
an internet-connected GitLab installation, GitLab checks the GitLab.com-hosted
|
2020-03-27 18:07:48 +00:00
|
|
|
container registry to check that you have the latest versions of these Docker images
|
|
|
|
and possibly connect to package repositories to install necessary dependencies.
|
2020-03-16 21:09:21 +00:00
|
|
|
|
2020-04-06 06:09:19 +00:00
|
|
|
In an offline environment, these checks must be disabled so that GitLab.com isn't
|
2020-03-16 21:09:21 +00:00
|
|
|
queried. Because the GitLab.com registry and repositories are not available,
|
|
|
|
you must update each of the scanners to either reference a different,
|
|
|
|
internally-hosted registry or provide access to the individual scanner images.
|
|
|
|
|
2020-03-27 18:07:48 +00:00
|
|
|
You must also ensure that your app has access to common package repositories
|
2020-03-16 21:09:21 +00:00
|
|
|
that are not hosted on GitLab.com, such as npm, yarn, or rubygems. Packages
|
|
|
|
from these repos can be obtained by temporarily connecting to a network or by
|
|
|
|
mirroring the packages inside your own offline network.
|
|
|
|
|
2020-03-27 18:07:48 +00:00
|
|
|
### Interacting with the vulnerabilities
|
|
|
|
|
2020-04-06 06:09:19 +00:00
|
|
|
Once a vulnerability is found, you can interact with it. Read more on how to
|
|
|
|
[interact with the vulnerabilities](../index.md#interacting-with-the-vulnerabilities).
|
2020-03-27 18:07:48 +00:00
|
|
|
|
2020-04-06 06:09:19 +00:00
|
|
|
Please note that in some cases the reported vulnerabilities provide metadata that can contain
|
|
|
|
external links exposed in the UI. These links might not be accessible within an offline environment.
|
2020-03-27 18:07:48 +00:00
|
|
|
|
2020-03-16 21:09:21 +00:00
|
|
|
### Scanner signature and rule updates
|
|
|
|
|
|
|
|
When connected to the internet, some scanners will reference public databases
|
|
|
|
for the latest sets of signatures and rules to check against. Without connectivity,
|
|
|
|
this is not possible. Depending on the scanner, you must therefore disable
|
|
|
|
these automatic update checks and either use the databases that they came
|
2020-03-27 18:07:48 +00:00
|
|
|
with and manually update those databases or provide access to your own copies
|
|
|
|
hosted within your network.
|
2020-03-16 21:09:21 +00:00
|
|
|
|
|
|
|
## Specific scanner instructions
|
|
|
|
|
|
|
|
Each individual scanner may be slightly different than the steps described
|
2020-04-08 03:09:31 +00:00
|
|
|
above. You can find more information at each of the pages below:
|
2020-03-16 21:09:21 +00:00
|
|
|
|
2020-04-06 06:09:19 +00:00
|
|
|
- [Container scanning offline directions](../container_scanning/index.md#running-container-scanning-in-an-offline-environment)
|
|
|
|
- [SAST offline directions](../sast/index.md#gitlab-sast-in-an-offline-environment)
|
|
|
|
- [DAST offline directions](../dast/index.md#running-dast-in-an-offline-environment)
|