Re: [http] Git error messages reveal password encoded in the URL

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Dnia wtorek 20. lipca 2010 01:25, Ketan Padegaonkar napisał:
> On 7/19/10 2:16 PM, Jacob Helwig wrote:
>> On Mon, Jul 19, 2010 at 14:10, Jakub Narebski<jnareb@xxxxxxxxx>  wrote:
>>> Dnia poniedziałek 19. lipca 2010 23:05, Jacob Helwig napisał:
>>>> On Mon, Jul 19, 2010 at 14:02, Jakub Narebski<jnareb@xxxxxxxxx>  wrote:
>>>>> Ketan Padegaonkar<ketanpadegaonkar@xxxxxxxxx>  writes:
>>>>>
>>>>>> We use http to serve our git repos, in order for git to not ask me a
>>>>>> username/password everytime,
> 
> Apologies. I used the wrong punctuation. It should read as:
> 
> We use https+basic auth to serve up git repos. Unfortunately SSH is not 
> an option for various reasons.

Is it because of firewall, or it is the issue with issuing shell 
accounts?  If the latter, you can use tools such as gitosis or gitolite
which need only one single shell account, and control access via public
key infrastructure.

> 
> In order for git to not ask me the username/password, I 'encoded' the 
> username/password into the url.

Can't you use ~/.netrc file[1] instead?  As far as I see this would not
show password info on error.  Not that the current situation should
not be fixed, but it might be worthwhile workaround for a time.

The ~/.netrc file would look like this for your example:

  machine host
  login user
  password pass

You should of course `chmod 600 ~/.netrc`

[1] This is unfortunately underdocumented: only this documentation
Documentation/howto/setup-git-server-over-http.txt mentions ~/.netrc
file.  I think that handling the $HOME/.netrc is done by the curl 
library that git uses, see libcurl-tutorial(3) manpage.

> I'm using git v1.7.1.1 on MacOSX Leopard. I can see the same behavior on 
> master (rev 24e7a5).

-- 
Jakub Narebski
Poland
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]