4

Protect Your git Repository’s .htpasswd

Posted on January 10, 2011 by Natan Yellin in Web Development

Update 2: WebFaction fixed their installer. You still need to fix this yourself if the repository was created before Jan 13, 2011. (Details here.)

Update: Git repositories created with WebFaction’s git installer are insecure, even when they’re password protected. Some Apache installations are configured out-of-the-box to protect .htpasswd files. That is not the case with WebFaction.

If you’re running a .git repository on WebFaction that was created by following their documentation, then you must:

  1. Remove the file’s default world-readable permissions, by running chmod o-r .htpasswd
  2. OR: Prevent the file from being downloaded, by adding the following to .htaccess:
<files ~ "^\.ht">
 Order allow,deny
 Deny from all
 </files>

Of course, the same applies to any .htpasswd file.

  1. Tweets that mention Protect Your git Repository’s .htpasswd | NatanYellin.com -- Topsy.com says:
    January 10, 2011 at 7:07 pm

    [...] This post was mentioned on Twitter by Zuissi, Natan Yellin. Natan Yellin said: New blog post: Protect Your git Repository's .htpasswd http://bit.ly/dTPKML [...]

    Reply
  2. Mickaël Wolff says:
    January 10, 2011 at 7:11 pm

    Actually, right bundled Apache does. Debian Apache package provide such a default access rule.

    Reply
  3. Project management software, wikis, and other technical infrastructure for small startups | NatanYellin.com says:
    January 25, 2011 at 2:15 pm

    [...] – and Redmine and git are easy installs anyways. You should be aware that there used to be a security vulnerability in WebFaction’s git installer. The problem has been fixed, but all repositories created before January 13 need to fix the issue [...]

    Reply