Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please stop serving .git to the outside world

pythonsweetness.tumblr.com

Post reply on HN
Print view View original

81–90 of 91 posts

Re: Please stop serving .git to the outside world

#81

Post by tingletech »

_wmd wrote: post #49
marijn wrote: post #42

This is too much of blanket statement. As long as there's nothing secret in the repository, serving up .git is perfectly fine. Both http://codemirror.net and http://ternjs.net (projects by me) have websites that are simply checkouts of the projects' repositories. Which were already public.

This is pretty much a blanket statement for any project of reasonable size (or even with just a sole clueless developer). But don't take my word for it, check the evidence first hand by poking around the list for yourself :) The solution is so effortless that it seems indefensible to serve .git, when the risk of doing so is a fleeting moment of forgetfulness leading to your site and databases getting pwned. Kind of l…

Back in the 90s I found I could get to /etc/passwd of a campus machine via anonymous ftp. I got all worried and I reported to the sysadmin, and they said anyone of the thousands of students who could log into the machine could read /etc/passwd anyway, and it was not a big deal because the passwords were in /etc/shadow and the anonymous ftp user could not read that file. This was back before ssh, and I think I expressed a concern about people knowing who had accounts on the machine, but you could tell if someone had an account via finger. Still seems like a bad idea to me. But if .git is from a public repo on github already I don't see the issue.

Re: Please stop serving .git to the outside world

#82

Post by tomedme »

bensedat wrote: post #69
koyote wrote: post #40

Earlier quoted context omitted.

Can you recommend a couple of good automated security tools?

https://www.tinfoilsecurity.com is a hosted automated security tool (Disclaimer: I work for Tinfoil)

Just tried it, not impressed.

"give us your email, give us your email, give us your email" on the first page isn't very welcoming, it sounds desperate. I can wait a short while for a scan (I came for the scan, not to give you my email address - what are you going to do with it, by the way?)

The scan returns 3 vulnerabilities - I have to create an account to see them. Alright, it's a "security company" (even though I've never heard of it before), how bad can it get? I have good spam filters anyway, whatever.

After creating the account, I have to verify I am the owner (this is a good thing!). I choose the meta tag option - it's broken, and the error is at the top of the page, not at the bottom where I have clicked "Verify". The link in the error doesn't even work.

So, I upload the HTML file, and proceed to my report, where the 3 vulnerabilities have reduced to 1, a vague "Entrance scan". Impossible to see the contents, the only possible action is another scan. which returns 0 vulnerabilities, my website is safe.

Just before closing the page, I notice my email address at the top right, I see "My Account" there... and it's a good thing I've checked, because I've been signed up to 2 newsletters.

Re: Please stop serving .git to the outside world

#83

Post by scubbo »

fallenhitokiri wrote: post #59
scubbo wrote: post #55

I feel incredible stupid asking this, but...how? I'm running a (very small) personal site on lighttpd, and updating it via git. I checked my.server.com/.git/config - and was duly served the config file. Eek! So I edited my /var/www/lighttpd/lighttpd.conf file, and added the following lines: $HTTP["url"] =~ ".git" { url.access-deny = ("") } and (I have used [asterisk] for the symbol, here, as otherwise it rendered my…

Instead of messing around with access and redirect stuff I would suggest, as others have in this thread, that you just put your files in a subdirectory and use this subdirectory as root for lighttpd. Problem solved with two commands and you can also add additional stuff to your repository like sources before they went through different processors (coffee script, SASS,...) or various drafts. This way you also have a f…

So, instead of having:

.git some_page.html some_css.css

You would advocate: .git web_docs/some_page.html web_docs/some_css.css

?

Makes sense. It will require some reorganisation, but it seems (from everyone's comments) to be best practice. Thanks!

(Still kinda bugs me that I can't work out how to prevent lighttpd from serving individual files, though!)

Re: Please stop serving .git to the outside world

#84

Post by scubbo »

fallenhitokiri wrote: post #59
scubbo wrote: post #55

I feel incredible stupid asking this, but...how? I'm running a (very small) personal site on lighttpd, and updating it via git. I checked my.server.com/.git/config - and was duly served the config file. Eek! So I edited my /var/www/lighttpd/lighttpd.conf file, and added the following lines: $HTTP["url"] =~ ".git" { url.access-deny = ("") } and (I have used [asterisk] for the symbol, here, as otherwise it rendered my…

Instead of messing around with access and redirect stuff I would suggest, as others have in this thread, that you just put your files in a subdirectory and use this subdirectory as root for lighttpd. Problem solved with two commands and you can also add additional stuff to your repository like sources before they went through different processors (coffee script, SASS,...) or various drafts. This way you also have a f…

OK, now I'm REALLY confused.

I've moved all my documents from /var/www/lighttpd/mainSite to /var/www/lighttpd/mainSite/webdocs (leaving .git in .../mainSite).

I've updated /etc/lighttpd/lighttpd.conf to point at /var/www/lighttpd/mainSite/webdocs, and confirmed that it's pointing at the right place by editing a file, and confirming that that change shows up on the site.

I've confirmed that there is no .git folder in webdocs (you never know!)

But calling my.site.com/.git/config still serves a file!?

Time to go ask on some lighttpd fora...

Re: Please stop serving .git to the outside world

#85

Post by _wmd »

scubbo wrote: post #84
fallenhitokiri wrote: post #59

Earlier quoted context omitted.

Instead of messing around with access and redirect stuff I would suggest, as others have in this thread, that you just put your files in a subdirectory and use this subdirectory as root for lighttpd. Problem solved with two commands and you can also add additional stuff to your repository like sources before they went through different processors (coffee script, SASS,...) or various drafts. This way you also have a f…

OK, now I'm REALLY confused. I've moved all my documents from /var/www/lighttpd/mainSite to /var/www/lighttpd/mainSite/webdocs (leaving .git in .../mainSite). I've updated /etc/lighttpd/lighttpd.conf to point at /var/www/lighttpd/mainSite/webdocs, and confirmed that it's pointing at the right place by editing a file, and confirming that that change shows up on the site. I've confirmed that there is no .git folder in…

Hit refresh in your browser. :)

Re: Please stop serving .git to the outside world

#86

Post by _wmd »

tingletech wrote: post #81
_wmd wrote: post #49

Earlier quoted context omitted.

This is pretty much a blanket statement for any project of reasonable size (or even with just a sole clueless developer). But don't take my word for it, check the evidence first hand by poking around the list for yourself :) The solution is so effortless that it seems indefensible to serve .git, when the risk of doing so is a fleeting moment of forgetfulness leading to your site and databases getting pwned. Kind of l…

Back in the 90s I found I could get to /etc/passwd of a campus machine via anonymous ftp. I got all worried and I reported to the sysadmin, and they said anyone of the thousands of students who could log into the machine could read /etc/passwd anyway, and it was not a big deal because the passwords were in /etc/shadow and the anonymous ftp user could not read that file. This was back before ssh, and I think I express…

So long as the initial checkout wasn't made via https://user:password@github.com/your/repo/ URL it might not be an issue. But git doesn't warn in this case, happily writes the password you provide in plaintext to your web root, and you may never notice anything is wrong until much later. If it's not that, then perhaps it's the rude comment made about a coworker in COMMIT_EDITMSG that you abandoned before committing..

Even if neither of these were the case, the general principle of unnecessarily exporting chunks of internal state is asking for trouble somewhere, even if you can't think of a good reason why it would bite today.

Re: Please stop serving .git to the outside world

#87

Post by rlpb »

dougws wrote: post #76
rlpb wrote: post #26

You can keep the same workflow but just have .git somewhere else. Just define GIT_DIR.

Last I checked, GIT_DIR wasn't actually respected by a lot of git subcommands. Is that no longer the case?

As far as I'm aware, it's respected by every git subcommand. I've never had a problem using it. Do you have any specific examples?

Re: Please stop serving .git to the outside world

#88

Post by scubbo »

_wmd wrote: post #85
scubbo wrote: post #84

Earlier quoted context omitted.

OK, now I'm REALLY confused. I've moved all my documents from /var/www/lighttpd/mainSite to /var/www/lighttpd/mainSite/webdocs (leaving .git in .../mainSite). I've updated /etc/lighttpd/lighttpd.conf to point at /var/www/lighttpd/mainSite/webdocs, and confirmed that it's pointing at the right place by editing a file, and confirming that that change shows up on the site. I've confirmed that there is no .git folder in…

Hit refresh in your browser. :)

Cleared the cache, refreshed, it's still there. Weirdness abounds.

Re: Please stop serving .git to the outside world

#89

Post by dan15 »

dsirijus wrote: post #22
dan15 wrote: post #17

.git should never be in your web root... I can't think of any situation (other than a very simple site) where you'd want to just stick the whole Git repository in the web root. Normally there's a bunch of other things in the repository (documentation, database scripts, etc.) that you wouldn't want exposed publicly.

You can hide it very easily with any of the virtual host syntax, and it's easy to deploy that way. I say, why not.

Hiding it is riskier than just not having it there in the first place. Why blacklist when you can whitelist?

Re: Please stop serving .git to the outside world

#90

Post by borski »

tomedme wrote: post #82
bensedat wrote: post #69

Earlier quoted context omitted.

https://www.tinfoilsecurity.com is a hosted automated security tool (Disclaimer: I work for Tinfoil)

Just tried it, not impressed. "give us your email, give us your email, give us your email" on the first page isn't very welcoming, it sounds desperate. I can wait a short while for a scan (I came for the scan, not to give you my email address - what are you going to do with it, by the way?) The scan returns 3 vulnerabilities - I have to create an account to see them. Alright, it's a "security company" (even though I'…

(Disclaimer: I'm a cofounder of Tinfoil)

Sorry about the experience you had! We only ask for your email address in the event that you leave the scan running and go away, so that we can email you a link to your report once the scan is finished.

We require verification before viewing any vulnerability data because we wouldn't want to show the vulnerabilities to someone who shouldn't have access. We'll take a look into the Meta tag issues you were having - normally that works great, but it's possible we messed something up.

The 3 vulnerabilities being reduced to 1 is /incredibly/ unusual, and we've never seen that before. Could you email me at borski@tinfoilsecurity.com with the URL or email associated with your account? I definitely want to look into this and fix it if there's an issue.

As for the two newsletters, you're more than welcome to unsubscribe. We think the information contained in those emails is actually very useful to anybody programming web applications, but we certainly understand that it is more useful for some than others. :)

TL;DR: Would love to fix the issues you ran into - please email me and we'll make it right. :)

Post reply on HN