Please stop serving .git to the outside world

Re:Please stop serving .git to the outside world by wldlyinaccurate on Monday June 10, 2013 @08:46AM (#5853934)

I recently discovered that I had been serving .git on my blog for a couple of years. All it took to fix was a simple rule in my Nginx config:

    # Don't expose hidden files to the web
    location ~ /\. {
        return 404;
    }

[ Parent | on HN ]

Re:Please stop serving .git to the outside world by fohlin on Monday June 10, 2013 @10:38AM (#5854665)

Though, keep in mind the potential conflict with /.well-known/ - <http://tools.ietf.org/html/rfc5785>.

[ Parent | on HN ]

Re:Please stop serving .git to the outside world by hafabnew on Monday June 10, 2013 @02:39PM (#5856184)

This isn't the best solution. Instead do as others have suggested and make a subdirectory of your project the webserver root.

This solutions just stops nginx (/whatever web server you're using) from displaying the file. If someone finds a remote-file inclusion vulnerability in your app, in all likelihood they can use said vulnerability to browse your .git directory -- because, hey, it's in your webserver directory, so the permissions are almost certainly set up so whatever user the webserver is running as (www-data probably/hopefully) can view it!

(Obviously if your webserver user can view important files such as these elsewhere on the system, you're still screwed -- but reducing attack surface, etc etc.)

[ Parent | on HN ]

Re:Please stop serving .git to the outside world by thejosh on Monday June 10, 2013 @10:02AM (#5854372)

Yep. It's good practice to disallow . files because one time you may forget you put one there.

[ Parent | on HN ]

Re:Please stop serving .git to the outside world by jaxbot on Monday June 10, 2013 @09:00AM (#5854010)

deny all; works too

[ Parent | on HN ]