One in every 600 websites has .git exposed

Re:One in every 600 websites has .git exposed by thaumaturgy on Sunday July 26, 2015 @09:35PM (#9952934)

FWIW I have a /private directory in the root of all vhosts, so it looks like:

    /srv/www/domain.com/public_html/
            |--------->/private/
            |--------->/logs/
            |--------->/tmp/

Anything stored in /private/ is not publicly accessible by the web server process, but can be read or written by anything running under the user's username.

It's specifically for storing things like configuration files.

I think this should be standard practice.

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by dangero on Sunday July 26, 2015 @09:39PM (#9952941)

Thanks for the tip. How do you keep passwords and keys in sync amongst team members safely?

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by thaumaturgy on Sunday July 26, 2015 @09:46PM (#9952957)

I only just recently had to figure that out. I opted for setting up a .kdb KeePass file in a private git repo and giving everyone ("everyone" = myself + one other) access to that. I'm pretty sure that's not a very good solution.

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by raquo on Sunday July 26, 2015 @11:57PM (#9953237)

Why do you store such stuff under /public_html anyway? One level higher would be more appropriate I think.

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by thaumaturgy on Monday July 27, 2015 @12:09AM (#9953288)

It's not under public_html. It's under /srv/www/domain.com. It is one level higher.

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by raquo on Monday July 27, 2015 @03:27AM (#9953862)

Oh, that makes more sense. Sorry I got confused by the ascii tree.

[ Parent | on HN ]