Add docs for sanitizing data sent to Support
Work in progress - MR coming soon.
Problem:
Customers may be unsure or unaware of how to properly sanitize data and files voluntarily submitted to GitLab Support.
Background:
GitLab Support requests that customers review and sanitize data that could potentially contain secrets before submitting it to Support. Support does not directly access, administer, or manage a self-managed customer's instance, server, or infrastructure.
However, there is nothing in place to prevent a customer from accidentally (but voluntarily) sharing secrets
As additional preventative measure, I propose documenting instructions on how to effectively sanitizing data sent to support, and linking to them when Support requests files or details that might potentially include secrets.
Proposal:
Add documentation on how to properly sanitize files submitted to support to our website.
I propose we add this below "working effectively in support tickets" here
Something along the lines of:
If relevant to the problem and helpful in troubleshooting, GitLab Support may request information regarding configuration files or logs.
GitLab Support encourages customers to review all data and files for sensitive data before adding them to a GitLab Support ticket.
Sensitive data may include, but is not limited to:
- credentials
- passwords
- tokens
- keys
- secrets
If manually added to a customer's self-managed configuration, this type of sensitive information may be contained in:
- `/etc/gitlab/gitlab.rb`
- `gitlab-runner` config
- `.gitlab-ci.yml` jobs
Please do not submit or share files without reviewing the contents and verifying that they are free of secrets and private information.
As a rule of thumb: If you or your company/organization is not comfortable sharing it, do not submit it - please.
To sanitize a `gitlab.rb` file before submitting:
- [gitlab.rb sanitizer](https://gitlab.com/gitlab-com/support/toolbox/gitlabrb_sanitizer):
`/opt/gitlab/embedded/bin/curl https://gitlab.com/gitlab-com/support/toolbox/gitlabrb_sanitizer/raw/master/sanitizer | /opt/gitlab/embedded/bin/ruby`
- grep -Ev "password|_key|token|secret|app_id|bind_dn|^$|^\s*#" /etc/gitlab/gitlab.rb
- manually review and remove secrets
Additionally, log files and traces may contain information for including:
- internal IP addresses
- domain names
- GitLab usernames and project names
To scrub this from the logs before submitting, we suggest using "search and replace" to replace any information you don't want to share with a unique placeholder. There are a number of ways to achieve this, including common command line utilities like `sed`.
- sed -i 's/secret/placeholder/g'
- sed -i 's/private.com/placeholder.com/g'
- sed -i 's/192.168.2.1/ip-address/g'
If a GitLab Support Engineer suspects that data was not effectively sanitized, we'll bring this to your attention in a reply and take action to redact the secrets.
If you believe secrets were accidentally shared or attached to a Support ticket, please [notifiy GitLab Support immediately](https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/35879/diffs) to ensure this data is deleted.