Skip to main content

此版本的 GitHub Enterprise 将停止服务 2023-01-18. 即使针对重大安全问题,也不会发布补丁。 为了获得更好的性能、更高的安全性和新功能,请升级到最新版本的 GitHub Enterprise。 如需升级帮助,请联系 GitHub Enterprise 支持

Enabling subdomain isolation

You can set up subdomain isolation to securely separate user-supplied content from other portions of your GitHub Enterprise Server appliance.

About subdomain isolation

Subdomain isolation mitigates cross-site scripting and other related vulnerabilities. For more information, see "Cross-site scripting" on Wikipedia. We highly recommend that you enable subdomain isolation on your GitHub Enterprise Server instance.

When subdomain isolation is enabled, GitHub Enterprise Server replaces several paths with subdomains. After enabling subdomain isolation, attempts to access the previous paths for some user-supplied content, such as http(s)://HOSTNAME/raw/, may return 404 errors.

Path without subdomain isolationPath with subdomain isolation
http(s)://HOSTNAME/assets/http(s)://assets.HOSTNAME/
http(s)://HOSTNAME/avatars/http(s)://avatars.HOSTNAME/
http(s)://HOSTNAME/codeload/http(s)://codeload.HOSTNAME/
http(s)://HOSTNAME/gist/http(s)://gist.HOSTNAME/
http(s)://HOSTNAME/media/http(s)://media.HOSTNAME/
http(s)://HOSTNAME/pages/http(s)://pages.HOSTNAME/
http(s)://HOSTNAME/raw/http(s)://raw.HOSTNAME/
http(s)://HOSTNAME/render/http(s)://render.HOSTNAME/
http(s)://HOSTNAME/reply/http(s)://reply.HOSTNAME/
http(s)://HOSTNAME/uploads/http(s)://uploads.HOSTNAME/
https://HOSTNAME/http(s)://docker.HOSTNAME/
https://HOSTNAME/_registry/npm/https://npm.HOSTNAME/
https://HOSTNAME/_registry/rubygems/https://rubygems.HOSTNAME/
https://HOSTNAME/_registry/maven/https://maven.HOSTNAME/
https://HOSTNAME/_registry/nuget/https://nuget.HOSTNAME/

Prerequisites

警告:如果禁用子网分隔,建议同时在企业上禁用 GitHub Pages。 无法将用户提供的 GitHub Pages 内容与其余企业数据分隔。 有关详细信息,请参阅“为企业配置 GitHub Pages”。

Before you enable subdomain isolation, you must configure your network settings for your new domain.

  • Specify a valid domain name as your hostname, instead of an IP address. For more information, see "Configuring a hostname."

警告:初始设置后不要更改 GitHub Enterprise Server 的主机名。 更改主机名将会导致意外的行为,甚至包括实例中断。

  • Set up a wildcard Domain Name System (DNS) record or individual DNS records for the subdomains listed above. We recommend creating an A record for *.HOSTNAME that points to your server's IP address so you don't have to create multiple records for each subdomain.
  • Get a wildcard Transport Layer Security (TLS) certificate for *.HOSTNAME with a Subject Alternative Name (SAN) for both HOSTNAME and the wildcard domain *.HOSTNAME. For example, if your hostname is github.octoinc.com, get a certificate with the Common Name value set to *.github.octoinc.com and a SAN value set to both github.octoinc.com and *.github.octoinc.com.
  • Enable TLS on your appliance. For more information, see "Configuring TLS."

Enabling subdomain isolation

  1. 从 GitHub Enterprise Server 上的管理帐户任意页面的右上角,单击

    用于访问站点管理员设置的火箭图标的屏幕截图

  2. 如果你尚未在“站点管理员”页上,请在左上角单击“站点管理员”。

    “站点管理员”链接的屏幕截图

  3. 在左侧边栏中,单击“管理控制台”。 左侧边栏中的 管理控制台 选项卡

  4. 在左侧边栏中,单击“主机名”。 “设置”边栏中的“主机名”选项卡

  5. Select Subdomain isolation (recommended). Checkbox to enable subdomain isolation

  6. 在左侧边栏下,单击“保存设置”。

    管理控制台 中的“保存设置”按钮的屏幕截图

    注意:保存 管理控制台 中的设置会重启系统服务,这可能会导致用户可察觉的停机时间。

  7. 等待配置运行完毕。

    配置实例