Filtering GitHub Upload with ZIA

To enable developers to effectively access GitHub, while still having controls to restrict/control access to upload data, Zscaler proposes that the agency leverage the Zscaler Internet Access (ZIA) platform for their development teams to provide more effective filtering and protection for GitHub, as well as other business applications and services.

Developers will install Zscaler Client Connector on their Windows or Mac workstations and authenticate themselves against a SAML service. Once authenticated, traffic from the workstation will be sent to the ZIA cloud proxy service where policy will govern how users can interact with Internet and cloud applications.

With ZIA, you will see three test cases and corresponding user and groups which can help to achieve different access scenarios and protection mechanisms targeting GitHub, as detailed in the table below:

GitHub Setup

GitHub has two service endpoints for communication with the cloud Git library as detailed in the table below:

Zscaler Setup

You can configure the following Zscaler configurations to implement the desired solution functionality:

1. URL Filtering Rules

   Rule #	Rule Name	Groups	Request Methods	URL Categories	Protocols	Action	Description
   1	Read-Only GitHub	GitHub-ReadOnly-Users	ALL	GitHub.com Upload Service URLs	HTTP PUT	Deny	This rule enables read-only (no-upload) for users that are a member of the GitHub-ReadOnly-Users group.
   2	Allow GitHub	GitHub-Unrestricted-Users; GitHub-ReadOnly-Users	ALL	GitHub.com Public Services	ALL	Allow	This rule enables users who are a member of the GitHub-Unrestrited-Users group to have full unrestricted access to GitHub. Users who are a member of the GitHub-ReadOnly-Users group will be able read GitHub, but will be blocked from uploading because of rule #1.
   3	Block GitHub	N/A	ALL	GitHub.com Public Services	ALL	Deny	This rule blocks GitHub access for any remaining users that did not match the Unrestricted or Read-Only access conditions.

2. Custom URL Categories

   Category Name	URLs	Keywords	Description
   GitHub.com Public Services	GitHub.com/upload codelab.GitHub.com GitHub.com	GitHub	Contains the service URL’s to categorize GitHub as an application as well as block signing up for GitHub
   GitHub.com Upload Service URLs	codelab.GitHub.com GitHub.com/upload	/commit_comment/ /create /delete /file-edit /issue /join /new /projects /repositories /tree-save /upload/ /wiki git-receive-pack	Contains any URL’s or keywords that match to GitHub’s upload service endpoints. git-receive-pack - github desktop - block push commit_comment – block commenting or editing a comment create – block creating delete – block deleting a file file-edit – block editing a file or commenting on it issue – block posting a new issue or editing an issue join – block creating an account new – block a new file projects – block creating a new project repositories – block /tree-save – block a commit action upload – block uploading a file wiki - block new and comments on wiki git-receive-pack – block desktop client from writing files

3. Cloud Firewall

   Z-Tunnel 2.0 is required to make use of the full functions of Cloud Firewall.

   Name	Destination IP Categories	Network Services	Action	Description
   Block Access to GitHub over SSH	GitHub.com Public Services	SSH	Block/Drop	Disable access to the GitHub SSH service endpoint which can allow upload of files, forcing all GitHub traffic to be routed over the web service endpoint.