Skip to content

Commit

Permalink
Hack week 2025: remove unneeded FBV instances (10) - Enterprise (#53952)
Browse files Browse the repository at this point in the history
Co-authored-by: Felicity Chapman <[email protected]>
  • Loading branch information
mchammer01 and felicitymay authored Jan 16, 2025
1 parent ba09681 commit eddcfd7
Show file tree
Hide file tree
Showing 24 changed files with 28 additions and 77 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -282,7 +282,7 @@ ghe-org-admin-promote -a

### ghe-reactivate-admin-login

Use this command to immediately unlock the {% data variables.enterprise.management_console %} after {% ifversion enterprise-authentication-rate-limits %}an account lockout. To configure authentication policies for {% data variables.location.product_location %}, see [AUTOTITLE](/admin/configuration/configuring-your-enterprise/configuring-rate-limits#configuring-authentication-policy-rate-limits).{% else %}10 failed login attempts in the span of 10 minutes.{% endif %}
Use this command to immediately unlock the {% data variables.enterprise.management_console %} after an account lockout. To configure authentication policies for {% data variables.location.product_location %}, see [AUTOTITLE](/admin/configuration/configuring-your-enterprise/configuring-rate-limits#configuring-authentication-policy-rate-limits).

```shell
ghe-reactivate-admin-login
Expand Down Expand Up @@ -376,7 +376,7 @@ inactive

### ghe-set-password

This utility allows you to set a new {% ifversion enterprise-management-console-multi-user-auth %}root site administrator {% endif %}password for authentication to the {% data variables.enterprise.management_console %}. For more information, see [AUTOTITLE](/admin/administering-your-instance/administering-your-instance-from-the-web-ui/managing-access-to-the-management-console).
This utility allows you to set a new root site administrator password for authentication to the {% data variables.enterprise.management_console %}. For more information, see [AUTOTITLE](/admin/administering-your-instance/administering-your-instance-from-the-web-ui/managing-access-to-the-management-console).

```shell
ghe-set-password
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ The {% data variables.enterprise.management_console %} allows you to manage the

You can always reach the {% data variables.enterprise.management_console %} using {% data variables.location.product_location %}'s IP address, even when the instance is in maintenance mode, or there is a critical application failure or hostname or SSL misconfiguration.

To access the {% data variables.enterprise.management_console %}, {% ifversion enterprise-management-console-multi-user-auth %}you can use the root site administrator password established during initial setup of {% data variables.location.product_location %} or log in as a {% data variables.enterprise.management_console %} user. For more information, see [AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/accessing-the-management-console). {% else %}you must use the administrator password established during initial setup of {% data variables.location.product_location %}. {% endif %}You must also be able to connect to the virtual machine host on port 8443. If you're having trouble reaching the {% data variables.enterprise.management_console %}, please check intermediate firewall and security group configurations.
To access the {% data variables.enterprise.management_console %}, you can use the root site administrator password established during initial setup of {% data variables.location.product_location %} or log in as a {% data variables.enterprise.management_console %} user. For more information, see [AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/accessing-the-management-console). You must also be able to connect to the virtual machine host on port 8443. If you're having trouble reaching the {% data variables.enterprise.management_console %}, please check intermediate firewall and security group configurations.

The {% data variables.enterprise.management_console %} password hash is stored in `/data/user/common/secrets.conf`. If high availability or clustering is configured, the file is automatically synced from the primary node to any additional nodes. Any change to the primary's password will automatically be replicated to all of the instance's nodes. For more information about high availability, see [AUTOTITLE](/admin/enterprise-management/configuring-high-availability/about-high-availability-configuration).

Expand All @@ -35,10 +35,10 @@ When someone performs an action in the {% data variables.enterprise.management_c
In the {% data variables.enterprise.management_console %}, you can perform administrative tasks for {% data variables.location.product_location %}, including:

* **Initial setup:** Walk through the initial setup process when first launching {% data variables.location.product_location %} by visiting {% data variables.location.product_location %}'s IP address in your browser.
{%- ifversion enterprise-management-console-multi-user-auth %}

* **Identity and access management:** Improve the security of {% data variables.location.product_location %} by creating dedicated user accounts for the {% data variables.enterprise.management_console %}. {% ifversion management-console-editor %}The root site administrator account can control these user accounts' access by assigning either the editor or operator role. {% endif %}For more information, see [AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/managing-access-to-the-management-console).{% ifversion management-console-editor %}
{% data reusables.enterprise.editor-role-note %}{% endif %}
{%- endif %}

* **Configuring authentication policies for the {% data variables.enterprise.management_console %}:** Set rate limits for login attempts, and the lockout duration if someone exceeds the rate limit. For more information, see [AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/managing-access-to-the-management-console#configuring-rate-limits-for-authentication-to-the-management-console).
* **Configuring basic settings for your instance:** Configure DNS, hostname, SSL, user authentication, email, monitoring services, and log forwarding on the Settings page.
* **Scheduling maintenance windows:** Take {% data variables.location.product_location %} offline while performing maintenance using the {% data variables.enterprise.management_console %} or administrative shell.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
title: Managing access to the Management Console
shortTitle: Manage Management Console access
intro: '{% ifversion enterprise-management-console-multi-user-auth %}You can increase the security of {% data variables.location.product_location %} by creating or deleting {% data variables.enterprise.management_console %} users. As the root site administrator, you {% else %}You {% endif %}can access the {% data variables.enterprise.management_console %} as well as configure {% data variables.enterprise.management_console %} authentication rate limits.'
intro: 'You can increase the security of {% data variables.location.product_location %} by creating or deleting {% data variables.enterprise.management_console %} users. As the root site administrator, you can access the {% data variables.enterprise.management_console %} as well as configure {% data variables.enterprise.management_console %} authentication rate limits.'
redirect_from:
- /admin/configuration/administering-your-instance-from-the-management-console/managing-access-to-the-management-console
versions:
Expand All @@ -18,8 +18,6 @@ topics:

{% ifversion ghes-manage-api-cli-extension %}You can also use the `gh es` {% data variables.product.prodname_cli %} extension to manage the root site administrator password, which controls access to the Management Console. For more information, see the [GH ES CLI usage documentation](https://github.com/github/gh-es/blob/main/USAGE.md#gh-es-access-set-password) and [AUTOTITLE](/admin/administering-your-instance/administering-your-instance-from-the-command-line/administering-your-instance-using-the-github-cli).{% endif %}

{% ifversion enterprise-management-console-multi-user-auth %}

## Types of {% data variables.enterprise.management_console %} accounts

There are two types of user accounts for the {% data variables.enterprise.management_console %} on a {% data variables.product.product_name %} instance. The root site administrator account authenticates with a password established during the initial setup of {% data variables.location.product_location %}.
Expand Down Expand Up @@ -72,10 +70,6 @@ If you have not configured email notifications for {% data variables.location.pr
1. To copy the invitation link, click {% octicon "link" aria-label="Copy invitation link" %} on any {% data variables.enterprise.management_console %} user account.
1. Send the invitation link to the {% data variables.enterprise.management_console %} user. The invitation link will lead the user through the final account setup steps.

{% endif %}

{% ifversion enterprise-authentication-rate-limits %}

## Configuring rate limits for authentication to the {% data variables.enterprise.management_console %}

You can configure the lockout time and login attempt limits for the {% data variables.enterprise.management_console %}.
Expand All @@ -87,5 +81,3 @@ After you configure rate limits and a {% data variables.enterprise.management_co
1. Optionally, under "Lockout time for Management Console users", type a number of minutes to lock the {% data variables.enterprise.management_console %} after too many failed login attempts. When locked out, the root site administrator must be manually unlocked.
1. Optionally, under "Login attempt limit for all users", type a maximum number of failed login attempts to allow before the {% data variables.enterprise.management_console %} is locked.
{% data reusables.enterprise_management_console.save-settings %}

{% endif %}
Original file line number Diff line number Diff line change
Expand Up @@ -20,18 +20,12 @@ If you experience problems accessing the Management Console, you can try the fol

## Unlocking the {% data variables.enterprise.management_console %} after failed login attempts

The {% data variables.enterprise.management_console %} locks after {% ifversion enterprise-authentication-rate-limits %}the number of failed login attempts configured by your authentication policies. For more information, see [AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/managing-access-to-the-management-console#configuring-rate-limits-for-authentication-to-the-management-console).{% else %}ten failed login attempts are made in the span of ten minutes. You must wait for the login screen to automatically unlock before attempting to log in again. The login screen automatically unlocks as soon as the previous ten minute period contains fewer than ten failed login attempts. The counter resets after a successful login occurs.{% endif %}

{% ifversion enterprise-management-console-multi-user-auth %}
The {% data variables.enterprise.management_console %} locks after the number of failed login attempts configured by your authentication policies. For more information, see [AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/managing-access-to-the-management-console#configuring-rate-limits-for-authentication-to-the-management-console).

### Unlocking the root site administrator account

{% endif %}

{% data reusables.enterprise_management_console.unlocking-management-console-with-shell %}

{% ifversion enterprise-management-console-multi-user-auth %}

### Unlocking a {% data variables.enterprise.management_console %} user account

The root site administrator can unlock access to the {% data variables.enterprise.management_console %} for other user accounts.
Expand All @@ -40,8 +34,6 @@ The root site administrator can unlock access to the {% data variables.enterpris
{% data reusables.enterprise_site_admin_settings.click-user-management %}
1. Locked user accounts will appear as "State: blocked". To unblock the user and allow authentication, to the right of the user's details, click {% octicon "law" aria-label="Unblock user" %}.

{%- endif %}

## Troubleshooting failed connections to the {% data variables.enterprise.management_console %}

If you cannot connect to the {% data variables.enterprise.management_console %} on {% data variables.location.product_location %}, you can review the following information to troubleshoot the problem.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ intro: 'You can migrate Docker images previously stored in the Docker registry o
product: '{% data reusables.gated-features.packages %}'
permissions: 'Enterprise owners can migrate Docker images to the {% data variables.product.prodname_container_registry %}.'
versions:
feature: docker-ghcr-enterprise-migration
ghes: '*'
shortTitle: Migrate to Container registry
topics:
- Containers
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ Before launching {% data variables.location.product_location %} on Azure, you'll
## Configuring the {% data variables.product.prodname_ghe_server %} virtual machine

To configure the instance, you must confirm the instance's status, upload a license file, set the {% ifversion enterprise-management-console-multi-user-auth %}root {% endif %} {% data variables.enterprise.management_console %} password, configure the instance's settings, and restart the instance.
To configure the instance, you must confirm the instance's status, upload a license file, set the root {% data variables.enterprise.management_console %} password, configure the instance's settings, and restart the instance.

{% data reusables.enterprise_installation.new-instance-attack-vector-warning %}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -84,21 +84,12 @@ If you include Markdown checkboxes in the message, all checkboxes must be select

Each time a user sees a mandatory message, an audit log event is created. The event includes the version of the message that the user saw. For more information see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise).

{% ifversion display-mandatory-message-again %} {% else %}

> [!NOTE]
> If you change the mandatory message for {% data variables.location.product_location %}, users who have already acknowledged the message will not see the new message.
{% endif %}

{% data reusables.enterprise-accounts.access-enterprise %}
{% data reusables.enterprise-accounts.settings-tab %}
{% data reusables.enterprise-accounts.messages-tab %}
1. To the right of "Mandatory message", click **Add mandatory message**.
1. Under "Mandatory message", in the text box, type your message.
{%- ifversion display-mandatory-message-again %}
1. Optionally, select **Show updated message to all users even if they dismissed the previous one**.
{% endif %}
{% data reusables.enterprise_site_admin_settings.message-preview-save %}

{% endif %}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ As an enterprise owner{% ifversion ghes %} or site administrator{% endif %}, you
* You can view the audit log for your enterprise. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/accessing-the-audit-log-for-your-enterprise).
* You can search the audit log for specific events{% ifversion ghec %} and export audit log data{% endif %}. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/searching-the-audit-log-for-your-enterprise){% ifversion ghec %} and [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise){% endif %}.{% ifversion token-audit-log %}
* You can identify all events that were performed by a specific access token. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token).{% endif %}{% ifversion ghes %}
* You can configure settings, such as the retention period for audit log events{% ifversion enable-git-events %} and whether Git events are included{% endif %}. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/configuring-the-audit-log-for-your-enterprise).{% endif %}
* You can configure settings, such as the retention period for audit log events and whether Git events are included. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/configuring-the-audit-log-for-your-enterprise).{% endif %}
{%- ifversion enterprise-audit-log-ip-addresses %}
* You can display the IP address associated with events in the audit log. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise).
{%- endif %}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,7 @@ topics:

You can configure a retention period for audit log data and see index storage details.

{% ifversion enable-git-events %}
After you configure a retention period, you can enable or disable Git-related events from appearing in the audit log.
{% endif %}

## Configuring a retention period for audit log data

Expand All @@ -31,15 +29,11 @@ You can configure a retention period for audit log data for {% data variables.lo
1. Under "Configure audit log retention settings", select the dropdown menu and click a retention period.
1. Click **Save**.

{% ifversion enable-git-events %}

## Managing Git events in the audit log

You can enable or disable Git-related events, such as `git.clone` and `git.push`, from appearing in your audit log. For a list of the Git events are logged, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#git).

{% ifversion ghes %}
If you do enable Git events, due to the large number of Git events that are logged, we recommend monitoring your instance's file storage and reviewing your related alert configurations. For more information, see [AUTOTITLE](/admin/enterprise-management/monitoring-your-appliance/recommended-alert-thresholds#monitoring-storage).
{% endif %}

Before you can enable Git events in the audit log, you must configure a retention period for audit log data other than "infinite." For more information, see [Configuring a retention period for audit log data](#configuring-a-retention-period-for-audit-log-data).

Expand All @@ -56,5 +50,3 @@ Before you can enable Git events in the audit log, you must configure a retentio
![Screenshot of the audit log. The checkbox to enable Git events in the audit log is highlighted with an orange outline.](/assets/images/help/enterprises/enable-git-events-checkbox.png)
1. Click **Save**.

{% endif %}
4 changes: 2 additions & 2 deletions content/packages/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,11 @@ featuredLinks:
- /packages/learn-github-packages/installing-a-package
popular:
- /packages/working-with-a-github-packages-registry/working-with-the-npm-registry
- '{% ifversion docker-ghcr-enterprise-migration %}/packages/working-with-a-github-packages-registry/migrating-to-the-container-registry-from-the-docker-registry{% endif %}'
- '{% ifversion ghes %}/packages/working-with-a-github-packages-registry/migrating-to-the-container-registry-from-the-docker-registry{% endif %}'
- /packages/learn-github-packages
- /packages/working-with-a-github-packages-registry/working-with-the-apache-maven-registry
guideCards:
- '{% ifversion docker-ghcr-enterprise-migration %}/packages/working-with-a-github-packages-registry/migrating-to-the-container-registry-from-the-docker-registry{% endif %}'
- '{% ifversion ghes %}/packages/working-with-a-github-packages-registry/migrating-to-the-container-registry-from-the-docker-registry{% endif %}'
- /packages/working-with-a-github-packages-registry/working-with-the-container-registry
- '{% ifversion packages-npm-v2 %}/packages/working-with-a-github-packages-registry/working-with-the-npm-registry{% endif %}'
- /packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry
Expand Down
Loading

0 comments on commit eddcfd7

Please sign in to comment.