diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template index fe989830d1f084fa9a7c5687cb506801d23b56fe_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..f8b28c110dbd3905af088fac6f1fa5a83fb02d59_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644 --- a/files/gitlab-config-template/gitlab.rb.template +++ b/files/gitlab-config-template/gitlab.rb.template @@ -1382,6 +1382,9 @@ # gitlab_sshd['ciphers'] = nil # gitlab_sshd['kex_algorithms'] = nil # gitlab_sshd['macs'] = nil +##! A list of the to be accepted public key algorithms. +##! For example: %w(ssh-ed25519 ecdsa-sha2-nistp256 rsa-sha2-256 rsa-sha2-512) +# gitlab_sshd['public_key_algorithms'] = nil # gitlab_sshd['login_grace_time'] = 60 # gitlab_sshd['host_keys_dir'] = '/var/opt/gitlab/gitlab-sshd' # gitlab_sshd['host_keys_glob'] = 'ssh_host_*_key' diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb index fe989830d1f084fa9a7c5687cb506801d23b56fe_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi..f8b28c110dbd3905af088fac6f1fa5a83fb02d59_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi 100644 --- a/files/gitlab-cookbooks/gitlab/attributes/default.rb +++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb @@ -778,6 +778,7 @@ default['gitlab']['gitlab_sshd']['ciphers'] = nil default['gitlab']['gitlab_sshd']['kex_algorithms'] = nil default['gitlab']['gitlab_sshd']['macs'] = nil +default['gitlab']['gitlab_sshd']['public_key_algorithms'] = nil default['gitlab']['gitlab_sshd']['login_grace_time'] = 60 default['gitlab']['gitlab_sshd']['host_keys_dir'] = '/var/opt/gitlab/gitlab-sshd' default['gitlab']['gitlab_sshd']['host_keys_glob'] = 'ssh_host_*_key' diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-shell_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-shell_spec.rb index fe989830d1f084fa9a7c5687cb506801d23b56fe_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItc2hlbGxfc3BlYy5yYg==..f8b28c110dbd3905af088fac6f1fa5a83fb02d59_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItc2hlbGxfc3BlYy5yYg== 100644 --- a/spec/chef/cookbooks/gitlab/recipes/gitlab-shell_spec.rb +++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-shell_spec.rb @@ -267,7 +267,7 @@ let(:templatesymlink) { chef_run.templatesymlink('Create a config.yml and create a symlink to Rails root') } let(:expected_sshd_keys) do %w[listen proxy_protocol proxy_policy web_listen concurrent_sessions_limit client_alive_interval - grace_period login_grace_time proxy_header_timeout macs kex_algorithms ciphers host_key_files host_key_certs] + grace_period login_grace_time proxy_header_timeout macs kex_algorithms ciphers public_key_algorithms host_key_files host_key_certs] end before do @@ -352,6 +352,24 @@ end end + context 'with custom public_key_algorithms' do + before do + stub_gitlab_rb( + gitlab_sshd: { + enable: true, + public_key_algorithms: %w(ssh-ed25519 ecdsa-sha2-nistp256 rsa-sha2-256 rsa-sha2-512), + } + ) + end + + it 'renders gitlab-sshd config' do + expect(chef_run).to render_file('/var/opt/gitlab/gitlab-shell/config.yml').with_content { |content| + data = YAML.safe_load(content) + expect(data['sshd']['public_key_algorithms']).to eq(%w(ssh-ed25519 ecdsa-sha2-nistp256 rsa-sha2-256 rsa-sha2-512)) + } + end + end + context 'log directory and runit group' do context 'default values' do it_behaves_like 'enabled logged service', 'gitlab-sshd', false, { log_directory_owner: 'git' }