Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please stop serving .git to the outside world

pythonsweetness.tumblr.com

Post reply on HN
Print view View original

51–60 of 91 posts

Re: Please stop serving .git to the outside world

#52

Post by contingencies »

koyote wrote: post #40
contingencies wrote: post #36

OK, so I knew about this one before. But if you didn't, there's a better solution than just remembering it, which seems to be the gist of this post. Solution: run one or more automated security tools across your sites, before deploying them to public locations. If possible, automate this process, so it happens all the time . The tools won't catch everything, but they will catch something you didn't, some of the time.…

Can you recommend a couple of good automated security tools?

http://w3af.org/ http://www.arachni-scanner.com/ http://www.openvas.org/ https://code.google.com/p/skipfish/

Re: Please stop serving .git to the outside world

#53

Post by eropple »

krapp wrote: post #48
rlx0x wrote: post #47

Earlier quoted context omitted.

> Being one configuration directive away from embarrassing failure is not a good idea. I can't stop but thinking about PHP webapps, for instance Wordpress serves wp-index.php in the same directory as wp-config.php, indeed only one configuration directive away from blowing it all up in your face. Every few months or so I encounter a huge site that serves me PHP source code. For instance the BBC: http://www.bbc.co.uk/r…

Why in the world would anyone serve a php file as .xml? That seems to be the problem... xml files are meant to be readable as text.

I would guess it's a configuration error around something like smart extensions, maybe? "If the clean URL has a .xml at the end, send the request through PHP."

Dumb, but it's the only thing I can come up with offhand.

Re: Please stop serving .git to the outside world

#55

Post by scubbo »

I feel incredible stupid asking this, but...how?

I'm running a (very small) personal site on lighttpd, and updating it via git. I checked my.server.com/.git/config - and was duly served the config file. Eek!

So I edited my /var/www/lighttpd/lighttpd.conf file, and added the following lines: $HTTP["url"] =~ ".git" { url.access-deny = ("") }

and (I have used [asterisk] for the symbol, here, as otherwise it rendered my text italic)

$HTTP["host"] =~ "(.[asterisk])" { url.redirect = ( "^/.git(.*)" => "%1/nope.html" ) }

And restarted the server.

But my.server.com/.git/config still served up the config file. What am I missing?

Re: Please stop serving .git to the outside world

#56

Post by marijn »

_wmd wrote: post #49
marijn wrote: post #42

This is too much of blanket statement. As long as there's nothing secret in the repository, serving up .git is perfectly fine. Both http://codemirror.net and http://ternjs.net (projects by me) have websites that are simply checkouts of the projects' repositories. Which were already public.

This is pretty much a blanket statement for any project of reasonable size (or even with just a sole clueless developer). But don't take my word for it, check the evidence first hand by poking around the list for yourself :) The solution is so effortless that it seems indefensible to serve .git, when the risk of doing so is a fleeting moment of forgetfulness leading to your site and databases getting pwned. Kind of l…

The repository is already public. It can't get any more public by being exposed over the website.

Re: Please stop serving .git to the outside world

#57

Post by dalore »

scubbo wrote: post #55

I feel incredible stupid asking this, but...how? I'm running a (very small) personal site on lighttpd, and updating it via git. I checked my.server.com/.git/config - and was duly served the config file. Eek! So I edited my /var/www/lighttpd/lighttpd.conf file, and added the following lines: $HTTP["url"] =~ ".git" { url.access-deny = ("") } and (I have used [asterisk] for the symbol, here, as otherwise it rendered my…

Another way would be to only deploy releases to your server and not have the .git directory at all. Look at git archive.

Re: Please stop serving .git to the outside world

#59

Post by fallenhitokiri »

scubbo wrote: post #55

I feel incredible stupid asking this, but...how? I'm running a (very small) personal site on lighttpd, and updating it via git. I checked my.server.com/.git/config - and was duly served the config file. Eek! So I edited my /var/www/lighttpd/lighttpd.conf file, and added the following lines: $HTTP["url"] =~ ".git" { url.access-deny = ("") } and (I have used [asterisk] for the symbol, here, as otherwise it rendered my…

Instead of messing around with access and redirect stuff I would suggest, as others have in this thread, that you just put your files in a subdirectory and use this subdirectory as root for lighttpd.

Problem solved with two commands and you can also add additional stuff to your repository like sources before they went through different processors (coffee script, SASS,...) or various drafts. This way you also have a full copy of everything you need for your site in case something happens to your workstation.

Post reply on HN