This is clearly Ops problem.
yes, but that doesn't make it not a dev problem.
devops
Please stop serving .git to the outside world
61–70 of 91 posts
Re: Please stop serving .git to the outside world
#62I make it a habit to put all my public files in directory such as www/, where as .git and other non public but site-related files/directories are contained above this.
Yes. I mean, even 6 year old PHP articles get this right, don't serve files from the same place your executing code is running from.
public_html has specific connotations for a reason.
Re: Please stop serving .git to the outside world
#63Earlier quoted context omitted.
Even a static site can be structured so that the .git directory is outside of the main public mount. This gives you a natural place to store notes, documentation, and other non-public content. It's not about screwing with the server config, it's so that it takes several stupid mistakes before your .git folder is flapping in the breeze, not just one. Being one configuration directive away from embarrassing failure is…
> Being one configuration directive away from embarrassing failure is not a good idea. I can't stop but thinking about PHP webapps, for instance Wordpress serves wp-index.php in the same directory as wp-config.php, indeed only one configuration directive away from blowing it all up in your face. Every few months or so I encounter a huge site that serves me PHP source code. For instance the BBC: http://www.bbc.co.uk/r…
WordPress can work with wp-config.php in your document root but it's recommended to move it 1 directory up (which is supported our of the box).
Re: Please stop serving .git to the outside world
#64I used to restrict that globally in my nginx / apache configurations (since I mainly work with these two web servers).
Re: Please stop serving .git to the outside world
#65I recently discovered that I had been serving .git on my blog for a couple of years. All it took to fix was a simple rule in my Nginx config: # Don't expose hidden files to the web location ~ /\. { return 404; }
This isn't the best solution. Instead do as others have suggested and make a subdirectory of your project the webserver root.
This solutions just stops nginx (/whatever web server you're using) from displaying the file. If someone finds a remote-file inclusion vulnerability in your app, in all likelihood they can use said vulnerability to browse your .git directory -- because, hey, it's in your webserver directory, so the permissions are almost certainly set up so whatever user the webserver is running as (www-data probably/hopefully) can view it!
(Obviously if your webserver user can view important files such as these elsewhere on the system, you're still screwed -- but reducing attack surface, etc etc.)
Re: Please stop serving .git to the outside world
#66I just push to a repo out of the web root that has a git hook which sets GIT_WORK_TREE to my web root and does a checkout.
Re: Please stop serving .git to the outside world
#67Earlier quoted context omitted.
Can you recommend a couple of good automated security tools?
http://w3af.org/ http://www.arachni-scanner.com/ http://www.openvas.org/ https://code.google.com/p/skipfish/
Very useful list. None of these have anything running as a service you can try out easily, I guess that would be a Bad Idea anyway as this kind of tools might either accidentally cause stuff to happen to a server, or be used as part of an attack. I guess script youngsters will not be very much deterred by having to install e.g. a python or ruby library - but any lazy bum that drops the idea to scan some elses site is a win.
Re: Please stop serving .git to the outside world
#68Earlier quoted context omitted.
Can you recommend a couple of good automated security tools?
http://w3af.org/ http://www.arachni-scanner.com/ http://www.openvas.org/ https://code.google.com/p/skipfish/
Very useful list. None of these have anything running as a service you can try out easily, I guess that would be a Bad Idea anyway as this kind of tools might either accidentally cause stuff to happen to a server, or be used as part of an attack. I guess script youngsters will not be very much deterred by having to install e.g. a python or ruby library - but any lazy bum that drops the idea to scan some elses site is a win.
Re: Please stop serving .git to the outside world
#69OK, so I knew about this one before. But if you didn't, there's a better solution than just remembering it, which seems to be the gist of this post. Solution: run one or more automated security tools across your sites, before deploying them to public locations. If possible, automate this process, so it happens all the time . The tools won't catch everything, but they will catch something you didn't, some of the time.…
Can you recommend a couple of good automated security tools?
https://www.tinfoilsecurity.com is a hosted automated security tool (Disclaimer: I work for Tinfoil)
Re: Please stop serving .git to the outside world
#70OK, so I knew about this one before. But if you didn't, there's a better solution than just remembering it, which seems to be the gist of this post. Solution: run one or more automated security tools across your sites, before deploying them to public locations. If possible, automate this process, so it happens all the time . The tools won't catch everything, but they will catch something you didn't, some of the time.…
Can you recommend a couple of good automated security tools?
[deleted]