Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One in every 600 websites has .git exposed

jamiembrown.com

Post reply on HN
Print view View original

51–60 of 214 posts

Re: One in every 600 websites has .git exposed

#51

Post by nostrademons »

Nate75Sanders wrote: post #27

Obviously you shouldn't be storing sensitive information in your codebase (I hope everybody knows that), but the problem here is that you might have been way back when you were prototyping and then moved them out of the codebase . It's really common to start a codebase just by hacking something together with hardcoded secrets. If you have the proper secret segregation now, but you're deploying by doing a git pull, no…

You probably should revoke all your existing credentials and replace them with fresh ones as soon as you pull them out of the VCS. That way, your attackers have the credentials, but they don't work anymore.

Re: One in every 600 websites has .git exposed

#52

Post by skarap »

Zarel wrote: post #11

Related question: Is there any risk to exposing .git if your Git repository is already publicly available (e.g. on GitHub)?

If you don't accidentally expose your credentials in .git/config to push changes to the repo (e.g. GitHub username/password for http auth) there is no risk.

Still - having a real deployment process is much better. It could be as easy as extracting the contents of a tarball generated by git archive.

Re: One in every 600 websites has .git exposed

#53

Post by morninj »

userbinator wrote: post #20
TheDong wrote: post #8

Earlier quoted context omitted.

Probably better to link to the stackoverflow you quite possibly copied this from so that people can see discussion / alternatives, etc: https://serverfault.com/questions/128069/how-do-i-prevent-ap... See also the nginx question: https://stackoverflow.com/questions/2999353/how-do-you-hide-... Note, if you actually did take it from the stackoverflow, you just infringed on someone's copyright; SO's user content is 'crea…

Note, if you actually did take it from the stackoverflow, you just infringed on someone's copyright Does a simple access rule, which I can't see there being many sane ways to express, meet the minimum level of creativity/originality to be eligible for copyright...?

Probably not, but it depends on the court and the skill of the lawyers.

Re: One in every 600 websites has .git exposed

#54

Post by nodesocket »

[deleted] wrote: post #45
hoodoof wrote: post #43

Someone on StackOverflow says this will tell nginx not to serve hidden files. location ~ /\. { return 403; } My question - do I need to put this once at the top of my configuration file and all it good or does it need to go into multiple places in the nginx config? It would be great if there was a simple, universal way to say to nginx "don't serve hidden files from anywhere under any circumstances".

[deleted]

Best thing for nginx is do an include in each server {} block.

    # /etc/nginx/deny-dot-files.conf
    location ~ /\. {
       access_log off;
       log_not_found off;
       deny all;
    }

    server {
        include /etc/nginx/deny-dot-files.conf;
    }

Re: One in every 600 websites has .git exposed

#56

Post by hoodoof »

Is there an automated "security as a service" service that if I subscribed to it, it would have told me that this is a problem on my websites?

It really annoys me randomly hearing about critical security issues through tech news websites - there should be a more systematic way for "non-security professionals" to ensure their sites are protected to best practice levels.

Re: One in every 600 websites has .git exposed

#57

Post by Dylan16807 »

phantom_oracle wrote: post #30

Imagine you implement every type of possible security... Keeping your entire server-stack up-to-date, making sure you have SSL, using strong encryption for logging-in, hashing the passwords, making sure your server can only be reached via SSH, adding firewalls, filters, etc. etc. Then some hacker in Eastern Europe comes along (or some beginner at the NSA/GCHQ) and finds out that your .git is exposed and somehow gains…

Wrong lesson.

Don't put secret keys in your repository.

Someone getting a copy of your code should be a big annoyance at worst.

Re: One in every 600 websites has .git exposed

#58

Post by totony »

phantom_oracle wrote: post #30

Imagine you implement every type of possible security... Keeping your entire server-stack up-to-date, making sure you have SSL, using strong encryption for logging-in, hashing the passwords, making sure your server can only be reached via SSH, adding firewalls, filters, etc. etc. Then some hacker in Eastern Europe comes along (or some beginner at the NSA/GCHQ) and finds out that your .git is exposed and somehow gains…

A good practice is to disable features that you don't use. I don't think many people need their hidden files to be remotely accessible, so maybe they should either remove the permissions or set a flag in their server so it doesn't allow downloading them.

Re: One in every 600 websites has .git exposed

#59

Post by Dylan16807 »

Nate75Sanders wrote: post #27

Obviously you shouldn't be storing sensitive information in your codebase (I hope everybody knows that), but the problem here is that you might have been way back when you were prototyping and then moved them out of the codebase . It's really common to start a codebase just by hacking something together with hardcoded secrets. If you have the proper secret segregation now, but you're deploying by doing a git pull, no…

Retroactively remove them from the commit history. Your sensitive secrets should not be on every developer machine.

Re: One in every 600 websites has .git exposed

#60

Post by therealmarv »

nodesocket wrote: post #46

In nginx, best to just not serve dot files: location ~ /\. { deny all; access_log off; log_not_found off; }

This returns 403 and in my opinion logs should not be turned off for that. I would return 404 to not expose that you are blocking . files with your server. My suggestion to put in each server { ... }

    location ~ /\.  { deny all; return 404; }
Post reply on HN