MFA For CI/CD Server

Posted by Splask@reddit | sysadmin | View on Reddit | 8 comments

So I'm at the end of a server MFA project and I have one machine left that giving me a huge headache. It's a Red Hat server running GitLab. So far I have been unable to find a way to put an MFA requirement on SSH sessions without breaking git operations, connections to runner servers, etc. Has anyone overcome this challenge before who could share some insight as to how you found and implemented a working solution? Many thanks in advance, I'd really love to get this thing completed.

Reply to Post

8 Comments

[-]

disposeable1200@reddit

Uh. You want SSO, put the MFA on that, then use the SSO everywhere

[-]

disposeable1200@reddit

And your servers should be using certificates or keys that rotate, not passwords... You don't MFA service accounts

[-]

Splask@reddit (OP)

There is no service account involved in this process.

[-]

disposeable1200@reddit

There should be between the repo and the servers running the code...

[-]

Splask@reddit (OP)

You just gonna come in here and tell me everything that's wrong and down vote all of my responses, or do you want to be kind and helpful? I'm respectfully asking for assistance in finding a solution. You're being a jerk on a throwaway account.

[-]

disposeable1200@reddit

Considering you've not even given enough info to be helped... What SSO are you using? What MFA are you using? So I'll just link a generic article that explains how it works as clearly you've got it all figured out https://smallstep.com/blog/diy-single-sign-on-for-ssh/ Also this account isn't actually a throwaway 🤣

[-]

Splask@reddit (OP)

It has SSO for the web interface, which does not need MFA. I need MFA for git operations that use SSH.

[-]

disposeable1200@reddit

Web interface should definitely have MFA... You should get someone to do a security review and give you a list of recommendations, sounds like you're far from secure.