Open Registration Default Setting Change

Several Customers have recently had their self hosted GitLab instance compromised unknowingly due to having "open registration" enabled which is a default configuration.

Analysis completed by the data team found that 80% of all enterprise customers have this turned off. It is unknown if the remaining 20% have this setting on intentionally or if they are unaware.

The recommended change (approved by Sid) is as follows:

New installs

  • Open Registration is default “closed”
  • People can still register to a “closed” instance - but an email is sent to administrator for “click” approval with a instruction on how to enable “open” registration

Future Release (can be determined at a later time)

  • Provide wizard-like selection of Open, Domain only, Closed during install

Current Customers

  • 1 time login banner to notify admins if registration is open with a link that provides more explanation (Sid: or link to the wizard?)
  • We will also track how many of these configurations change post-banner to assess and report on impact as an FYI

Product doc covering several weeks discussion, questions and analysis can be found here: https://docs.google.com/document/d/1D9rW65d4w0UwSRw_0jJMRk5wAxdhAd4ynrHLbMMwIjo/edit# (currently item #9 (closed) - subject to change as items are added/removed)

Work for this change can be tracked here: gitlab-org&4214

Edited by Johnathan Hunt