2 factor authentication fails on GitLab.com

GitLab.com is running 7.12.0.rc1-ee cd29cff .

User with enabled 2FA cannot login, error is:

worker1 production.log: Completed 500 Internal Server Error in 39ms
worker1 production.log: 
worker1 production.log: OpenSSL::Cipher::CipherError (bad decrypt):
worker1 production.log:   app/controllers/sessions_controller.rb:95:in `valid_otp_attempt?'
worker1 production.log:   app/controllers/sessions_controller.rb:63:in `authenticate_with_two_factor'
worker1 production.log: 

@dzaporozhets @rspeicher Any ideas?

Also in https://dev.gitlab.org/gitlab/gitlabhq/issues/2405

mentioned in issue #1810 (closed)

We found the problem: we accidentally rotated the secret key used to encrypt individual user OTP secrets stored in the database on gitlab.com. The rotation happened now because of omnibus-gitlab@757aced2 .

Next steps:

• rotate the encryption key again
• disable 2FA for all gitlab.com users
• email users who had 2FA before that they need to re-register their device
• discuss whether we should have more than one secret_token for GitLab

We retrieved the old key, not rotating for now.

Where is the key? i have the same problem.

It is the .secret file in the Rails root (the directory that has config.ru and GITLAB_SHELL_VERSION files in it).

thanks, but... i think i had lost the .secret... It's only for the 2 factor authentication? How can i disable the 2 factor authentication for one user? i'am the only user on my gitlab server.

This should turn it off for all users on your gitlab server: sudo gitlab-rails runner 'User.update_all(otp_required_for_login: false, encrypted_otp_secret: "")'.

Thank you very much! :thumbsup::thumbsup::thumbsup:

Added 2fa label

mentioned in issue #1960 (moved)

Milestone changed to 8.0

@marin what is the status of this issue?

@dzaporozhets the backup documentation has been improved, see https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/raketasks/backup_restore.md#create-a-backup-of-the-gitlab-system

Status changed to closed

mentioned in issue #1960 (moved)

mentioned in merge request !14785