gitlab-org--gitlab-foss/doc/security/ssh_keys_restrictions.md

# Restrict allowed SSH key technologies and minimum length

`ssh-keygen` allows users to create RSA keys with as few as 768 bits, which
falls well below recommendations from certain standards groups (such as the US
NIST). Some organizations deploying GitLab will need to enforce minimum key
strength, either to satisfy internal security policy or for regulatory
compliance.

Similarly, certain standards groups recommend using RSA, ECDSA, or ED25519 over
the older DSA, and administrators may need to limit the allowed SSH key
algorithms.

GitLab allows you to restrict the allowed SSH key technology as well as specify
the minimum key length for each technology.

In the Admin area under **Settings** (`/admin/application_settings`), look for
the "Visibility and Access Controls" area:

![SSH keys restriction admin settings](img/ssh_keys_restrictions_settings.png)

If a restriction is imposed on any key type, users will be unable to upload new SSH keys that don't meet the requirement. Any existing keys that don't meet it will be disabled but not removed and users will be unable to pull or push code using them.

An icon will be visible to the user of a restricted key in the SSH keys section of their profile:

![Restricted SSH key icon](img/ssh_keys_restricted_key_icon.png)

Hovering over this icon will tell you why the key is restricted.
Add settings for minimum key strength and allowed key type This is an amalgamation of: * Cory Hinshaw: Initial implementation !5552 * Rémy Coutable: Updates !9350 * Nick Thomas: Resolve conflicts and add ED25519 support !13712 2017-08-21 10:30:03 +00:00			`# Restrict allowed SSH key technologies and minimum length`

			`ssh-keygen` allows users to create RSA keys with as few as 768 bits, which
			`falls well below recommendations from certain standards groups (such as the US`
Address review comments 2017-08-28 20:33:35 +00:00			`NIST). Some organizations deploying GitLab will need to enforce minimum key`
Add settings for minimum key strength and allowed key type This is an amalgamation of: * Cory Hinshaw: Initial implementation !5552 * Rémy Coutable: Updates !9350 * Nick Thomas: Resolve conflicts and add ED25519 support !13712 2017-08-21 10:30:03 +00:00			`strength, either to satisfy internal security policy or for regulatory`
			`compliance.`

Address review comments 2017-08-28 20:33:35 +00:00			`Similarly, certain standards groups recommend using RSA, ECDSA, or ED25519 over`
			`the older DSA, and administrators may need to limit the allowed SSH key`
			`algorithms.`
Add settings for minimum key strength and allowed key type This is an amalgamation of: * Cory Hinshaw: Initial implementation !5552 * Rémy Coutable: Updates !9350 * Nick Thomas: Resolve conflicts and add ED25519 support !13712 2017-08-21 10:30:03 +00:00
			`GitLab allows you to restrict the allowed SSH key technology as well as specify`
			`the minimum key length for each technology.`

			In the Admin area under Settings (`/admin/application_settings`), look for
			`the "Visibility and Access Controls" area:`

			`![SSH keys restriction admin settings](img/ssh_keys_restrictions_settings.png)`
Docs: add details about restricted SSH keys 2019-02-22 16:55:43 +00:00
			`If a restriction is imposed on any key type, users will be unable to upload new SSH keys that don't meet the requirement. Any existing keys that don't meet it will be disabled but not removed and users will be unable to pull or push code using them.`

			`An icon will be visible to the user of a restricted key in the SSH keys section of their profile:`

			`![Restricted SSH key icon](img/ssh_keys_restricted_key_icon.png)`

			`Hovering over this icon will tell you why the key is restricted.`