Project: Checkov (Provisioning / Security & Compliance)
File: Gitlab.md

layout: default published: true title: Gitlab configuration scanning nav_order: 20 Checkov supports the evaluation of policies on your Gitlab organization and repositories settings. When using checkov with Gitlab token it can collect your current org settings and validate it complies with Gitlab security best practices such as having 2FA defined, having SSO and more. Full list of gitlab organization and repository settings related checks can be found . | Environment Variable | Default value | Description | |-|-|-| | CKVGITLABCONFIGFETCHDATA| "True" | checkov will try to fetch Gitlab configuration from API by default (unless no access token provided) | | CKVGITLABCONFDIRNAME | "gitlabconf" | checkov will create a new directory named "gitlabconf" under current working directory | | CISERVERURL | "https://gitlab.com/" | | | CIJOBTOKEN | | Gitlab personal access token to be used to fetch Gitlab configuration | ```json [ { "id": 15483421, "web_url": "https://gitlab.com/groups/baraktest1", "name": "baraktestgroup", "path": "baraktest1", "description": "", "visibility": "private", "sharewithgroup_lock": false, "requiretwofactor_authentication": false, "twofactorgrace_period": 48, "projectcreationlevel": "developer", "autodevopsenabled": null, "subgroupcreationlevel": "maintainer", "emails_disabled": null, "mentions_disabled": null, "lfs_enabled": true, "defaultbranchprotection": 2, "avatar_url": null, "requestaccessenabled": true, "full_name": "baraktestgroup", "full_path": "baraktest1", "created_at": "2022-01-17T11:03:19.763Z", "parent_id": null, "ldap_cn": null, "ldap_access": null } ] ``` ```python from checkov.common.models.enums import CheckCategories, CheckResult from checkov.gitlab.basegitlabconfiguration_check import BaseGitlabCheck from checkov.gitlab.schemas.groups import schema from checkov.json_doc.enums import BlockType class GroupsTwoFactorAuthentication(BaseGitlabCheck): def init(self): name = "Ensure all Gitlab groups require two factor authentication" id = "CKVGITLAB2" categories = [CheckCategories.SUPPLY_CHAIN] super().init( name=name, id=id, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scanentityconf(self, conf): if schema.validate(conf): for group in conf: if group.get("requiretwofactor_authentication", False) is True: return CheckResult.PASSED, conf return CheckResult.FAILED, conf check = GroupsTwoFactorAuthentication() ``` ```bash export CIJOBTOKEN="ghp_abc" export REQUESTSCABUNDLE="/usr/local/etc/openssl/cert.pem" export BCCABUNDLE="globalprotect_certifi.txt" checkov -d . --framework gitlab_configuration ``` ```bash _| | _ | | / | '_ \ / _ \/ | |/ / _ \ \ / / | (| | | | / (| < (_) \ V / \_|_| |_|\|\|_|\_\/ \/ By Prisma Cloud | version: 2.0.722 gitlab_configuration scan results: Passed checks: 0, Failed checks: 1, Skipped checks: 0 Check: CKVGITLAB2: "Ensure all Gitlab groups require two factor authentication" FAILED for resource: /gitlab_conf/groups.json File: /gitlab_conf/groups.json:2-27 2 | { 3 | "id": 15483421, 4 | "web_url": "https://gitlab.com/groups/baraktest1", 5 | "name": "baraktestgroup", 6 | "path": "baraktest1", 7 | "description": "", 8 | "visibility": "private", 9 | "sharewithgroup_lock": false, 10 | "requiretwofactor_authentication": false, 11 | "twofactorgrace_period": 48, 12 | "projectcreationlevel": "developer", 13 | "autodevopsenabled": null, 14 | "subgroupcreationlevel": "maintainer", 15 | "emails_disabled": null, 16 | "mentions_disabled": null, 17 | "lfs_enabled": true, 18 | "defaultbranchprotection": 2, 19 | "avatar_url": null, 20 | "requestaccessenabled": true, 21 | "full_name": "baraktestgroup", 22 | "full_path": "baraktest1", 23 | "created_at": "2022-01-17T11:03:19.763Z", 24 | "parent_id": null, 25 | "ldap_cn": null, 26 | "ldap_access": null 27 | } Process finished with exit code 1 ``` To add more GitLab policies and configuration to be inspected take a look at the