系統環境描述
System information System: Ubuntu 14.04 Current User: git Using RVM: no Ruby Version: 2.1.5p273 Gem Version: 2.2.1 Bundler Version:1.5.3 Rake Version: 10.3.2 Sidekiq Version:3.3.0 GitLab information Version: 7.8.1 Revision: e2d785c Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: postgresql URL: https://git.zhuima.com HTTP Clone URL: https://git.zhuima.com/some-project.git SSH Clone URL: ssh://git@git.zhuima.com:10086/zhuima.git Using LDAP: yes Using Omniauth: no GitLab Shell Version: 2.5.4 Repositories: /data/gitlab/data/repositories Hooks: /opt/gitlab/embedded/service/gitlab-shell/hooks/ Git: /opt/gitlab/embedded/bin/git
問題癥狀
每天總有一段時間會出現403的情況 辦公網不能訪問位
拍錯思路
1、日志中出現401、403狀態嗎
2、gitlab-rake gitlab:check發現的問題 [修復未能解決問題]
zhuima-library / yii-framework ... no Try fixing it: sudo -u git -H bundle exec rake gitlab:satellites:create RAILS_ENV=production If necessary, remove the tmp/repo_satellites directory ... ... and rerun the above command For more information see: doc/raketasks/maintenance.md
3、網上的文檔搜索相關文檔
http://boardreader.com/thread/Gitlab_7_10_4_Forbidden_Error_56o55lX769.html 懷疑是rack_attack.rb文件的策略導致的，修改文件,重啟不生效
rack_attack.rb文件的額配置，修改1s并發300不生效?。。。?！
unless Rails.env.test?
Rack::Attack.throttle('protected paths', limit: 300, period: 1.seconds) do |req|
if req.post? && req.path =~ paths_regex
req.ip
end
end
end
其他
每次服務中斷時間為1小時
該時間段內沒有設置任務計劃 gitlab是通過ladp進行賬號驗證的
僅僅辦公網不能正常訪問gitlab，外部網絡訪問正常
1、僅僅辦公網不能正常訪問gitlab，外部網絡訪問正常 2、辦公網絡開發人數150+ 3、并發30+
需要解決的問題
想要的效果
1、如何禁用rack_attack.rb的策略 2、穩定的服務
相關日志
Started GET "/" for 127.0.0.1 at 2015-09-02 16:57:50 +0800 Processing by DashboardController#show as */* Completed 401 Unauthorized in 44ms ========= ==> /var/log/gitlab/nginx/gitlab_access.log <== 118.187.12.36 - - [02/Sep/2015:16:47:33 +0800] "GET /zhuima-egg/zhuima.git/info/refs?service=git-upload-pack HTTP/1.1" 403 20 "-" "git/1.9.5.msysgit.1"
排錯過程中所做的操作
1_settings.rb中定義的
1_settings.rb中添加白名單，生效，但是gitlab-ctl reconfigure之后配置被初始化
Settings['rack_attack'] ||= Settingslogic.new({})
Settings.rack_attack['git_basic_auth'] ||= Settingslogic.new({})
Settings.rack_attack.git_basic_auth['enabled'] = true if Settings.rack_attack.git_basic_auth['enabled'].nil?
Settings.rack_attack.git_basic_auth['ip_whitelist'] ||= %w{127.0.0.1}
Settings.rack_attack.git_basic_auth['ip_whitelist'] ||= %w{118.187.12.36}
Settings.rack_attack.git_basic_auth['maxretry'] ||= 10
Settings.rack_attck.git_basic_auth['findtime'] ||= 1.minute
Settings.rack_attack.git_basic_auth['bantime'] ||= 1.hour
禁用rack_attack.rb文件
http://boardreader.com/thread/Gitlab_7_10_4_Forbidden_Error_56o55lX769.html
關于rack_attack
rack-attack: 基于 Rack 的防攻擊中間件 https://github.com/kickstarter/rack-attack https://github.com/kickstarter/rack-attack/wiki/Example-Configuration
官方文檔的解釋：
http://doc.gitlab.com/ce/security/rack_attack.html http://boardreader.com/thread/Gitlab_7_10_4_Forbidden_Error_56o55lX769.html
rack_attack配置在案例·
https://gitlab.com/gitlab-org/omnibus-gitlab/issues/480
gitlab-ce 9.10歸檔整理
https://about.gitlab.com/downloads/archives/
gitlab 7.9版本之后的rack_attack.rb配置示例：
https://github.com/kickstarter/rack-attack/wiki/Example-Configuration
參考文檔
https://code.csdn.net/zhanglushan/gitlabhq/tree/0b1cf50060de0d0a3039dfb2fca47364c7fb5f82/doc/raketasks/maintenance.md
原創文章，作者：追馬，如若轉載，請注明出處：http://www.www58058.com/7982
