3 ms·
Would putting your Gitlab instance behind a VPN mitigate this issue and similar? At least, it would limit attackers to malicious people with VPN access.
by henning 5y ago
Would putting your Gitlab instance behind a VPN mitigate this issue and similar? At least, it would limit attackers to malicious people with VPN access.
- staunch 5y agoYes, it would. Most people should put their internal cloud infrastructure behind a VPN, if at all possible. It's easy to do and dramatically reduces the surface area for an attacker. It's not a silver bullet but in many cases it will be the difference between getting hacked and not getting hacked. It is totally possible to design applications that can be safely exposed to the public internet but it requires some real effort.
- jodoherty 5y agoIt would dramatically limit your attack surface to those who could gain access to your VPN. I prefer requiring TLS mutual authentication with a corporate PKI and issuing employees client certificates. Doing both wouldn't be a bad idea either.
- relaunched 5y agoThe number of software products, SaaS and on-prem, that don't support mutual tls is a disgrace.
- tfigment 5y agoI frequently do mTLS with a reverse proxy (httpd, nginx, caddy, ...). Not perfect but you can tighten the connection security a lot without touching the other service. But by outsourcing it you lose some control.
- PLG88 5y agoWe put all our DevOps tools behind Open Ziti (ziti.dev) which ensures we do not need any public IPs (unlike a VPN or bastion) while giving granular access control for only trusted users.