After https://gitlab.com/gitlab-org/gitlab-foss/-/issues/62756 / https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/30467, we're logging the user information on `auth.log`, but only for Rack::Attack throttle events. It'd be useful to have the same information for blacklist events. ### Technical bits From https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/30467#note_189543725: > It looks like in Omnibus (`/opt/gitlab/embedded/service/gitlab-rails/config/initializers/rack_attack.rb`), we have: ```ruby Rack::Attack.throttle('protected paths', limit: 10, period: 60.seconds) do |req| if req.post? && req.path =~ paths_regex req.ip end end ``` > In this case we're returning the IP, and I think there are cases from support where we would like to have the username in this case. ### Backend Plan On %"12.4" * [x] Move the protected paths into GitLab-Rails - https://gitlab.com/gitlab-org/gitlab/merge_requests/16463 * [x] Handle the throttle like the other ones on [`RackAttackGlobal`](https://gitlab.com/gitlab-org/gitlab/blob/master/config/initializers/rack_attack_global.rb) - https://gitlab.com/gitlab-org/gitlab/merge_requests/16463 * [x] Update GitLab rails documentation - https://gitlab.com/gitlab-org/gitlab/merge_requests/16540 * [x] Deprecate protected paths on Omnibus - https://gitlab.com/gitlab-org/omnibus-gitlab/issues/4688 - https://gitlab.com/gitlab-org/omnibus-gitlab/merge_requests/3597/diffs - Users who have configured Omnibus can continue to use their deprecated settings. - Deprecation might be done with https://docs.gitlab.com/omnibus/development/adding-deprecation-messages.html * [x] Update Omnibus documentation to indicate the setting is deprecated. - https://gitlab.com/gitlab-org/omnibus-gitlab/merge_requests/3597 On %12.5 * [x] Clarify the documentation on https://docs.gitlab.com/ee/user/admin_area/settings/protected_paths.html#migrate-settings-from-gitlab-123-and-earlier * [x] Fix documentation https://gitlab.com/gitlab-org/gitlab/blob/v12.4.2-ee/doc/user/admin_area/settings/protected_paths.md#migrate-settings-from-gitlab-123-and-earlier as mentioned in the comment below https://gitlab.com/gitlab-org/gitlab/issues/29952#note_239927289 * [x] Remove `A web server restart is required after changing these settings.` from app/views/admin/application_settings/network.html.haml => https://gitlab.com/gitlab-org/gitlab/-/merge_requests/26846 * [x] Change `Omnibus Protected Paths throttle is active.` to `Omnibus Protected Paths throttle is active, and takes priority over these settings.` => https://gitlab.com/gitlab-org/gitlab/-/merge_requests/26846 On %"13.0" Because of the [Omnibus deprecated policy](https://docs.gitlab.com/omnibus/package-information/deprecation_policy.html), we have to wait until the next major release (%"13.0") to continue with the following items: * [x] Remove protected paths and rack attack from Omnibus, and update documentation - https://gitlab.com/gitlab-org/omnibus-gitlab/issues/4750 * [x] Remove protected paths code from GitLab codebase - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/31221 * [x] Remove `rack_attack.rb.example` from GitLab-Rails * [x] Remove [`rack_attack.rb.example` source installation documentation](https://gitlab.com/gitlab-org/gitlab/blob/v12.4.0-ee/doc/security/rack_attack.md#L143) and other related text in this doc * [x] Remove Omnibus specific methods on `config/initializers/rack_attack_new.rb` * [x] Remove `admin_area_protected_paths_enabled` setting and related code https://gitlab.com/gitlab-org/gitlab/merge_requests/21090 * [x] Remove protected paths code from Omnibus codebase https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/3773/ * [x] https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/4149 * [x] https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/4207 * [x] We also need to update [`gitlab-rails Dockerfile`](https://gitlab.com/gitlab-org/build/CNG-mirror/blob/master/gitlab-rails/Dockerfile.erb#L105) from CNG mirror * [x] Add to the 13.0 release post: Tell people to double-check that the protected paths application settings are the way they want them since the deprecated Omnibus code is being removed. It is possible that a small percentage of installations expect it to be enabled but it isn't: https://gitlab.com/gitlab-org/gitlab/merge_requests/19185#note_236722245 * Suggested to make a note about it on the "Upgrade Notes" section of the release post: https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_requests/48907#note_341014671 * It was added on removals https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_requests/48596 On %13.1 * [-] Rename `rack_attack_new.rb` back to `rack_attack.rb`. Follow up issue created https://gitlab.com/gitlab-org/gitlab/-/issues/218291 ### Development log * Merge request was created to add Protected paths configuration into GitLab-rails - https://gitlab.com/gitlab-org/gitlab/merge_requests/16463 * GitLab documentation is going to be updated on https://gitlab.com/gitlab-org/gitlab/merge_requests/16540 * An issue on Omnibus GitLab was created to decide the removal target date of the Protected Path settings on Omnibus https://gitlab.com/gitlab-org/omnibus-gitlab/issues/4688 * Merge request that adds a deprecation notice and updates Omnibus documentation - https://gitlab.com/gitlab-org/omnibus-gitlab/merge_requests/3597 * Because the protected path throttle also exists on Omnibus, a manual test was done by Stan to check the behavior of both throttles * It was decided to ignore the application setting throttle if Omnibus settings are present https://gitlab.com/gitlab-org/gitlab/merge_requests/16463#note_218518797 * From the Omnibus [Deprecation policy](https://docs.gitlab.com/omnibus/package-information/deprecation_policy.html), removal target of Omnibus throttle will be on the next major release (%13.0) * Issue on Omnibus https://gitlab.com/gitlab-org/omnibus-gitlab/issues/4750 * Merge request to fix a broken link on "Protected paths" setting was created - https://gitlab.com/gitlab-org/gitlab/merge_requests/17945