Git error messages reveal password encoded in the URL
Hi,
We use http to serve our git repos, in order for git to not ask me a username/password everytime, I've put the following in my .git/config:
[remote "origin"]
url = https://user:pass@host/repo.git
What is discerning is that every time git encounters a problem connecting to the repo, I get the following error containing both my username and password.
error: Couldn't resolve host 'host' while accessing https://user:pass@host/repo.git/info/refs
I would like to suggest that the password be removed/masked from this error message.
Signature · 2 lines
Ketan http://ketan.padegaonkar.name | http://eclipse.org/swtbot
Quoted 2 lines · Ketan Padegaonkar
We use http to serve our git repos, in order for git to not ask me a username/password everytime,
Errr... WTF? Can't you configure SSH (use ssh-add, perhaps together with tool such as keychain) to use public key based authentication?
Quoted 9 lines
I've put the following in my .git/config:
[remote "origin"]
url = https://user:pass@host/repo.gitWhat is discerning is that every time git encounters a problem connecting to the repo, I get the following error containing both my username and password.
Quoted 5 lines
error: Couldn't resolve host 'host' while accessing
https://user:pass@host/repo.git/info/refsI would like to suggest that the password be removed/masked from this error message.
Which git version do you use? I recall vaguely that something was done in this direction (masking passwords in URLs).
Signature · 3 lines
Jakub Narebski Poland ShadeHawk on #git
Quoted 8 lines · Jakub Narebski
Quoted 2 lines · Ketan Padegaonkar
We use http to serve our git repos, in order for git to not ask me a username/password everytime,
Errr... WTF? Can't you configure SSH (use ssh-add, perhaps together with tool such as keychain) to use public key based authentication?
I don't think SSH/ssh-agent/pubkey would actually help, given that it's a https URL. Unless I'm missing something here?
Quoted 5 lines
Quoted 5 lines
I've put the following in my .git/config:
[remote "origin"]
url = https://user:pass@host/repo.git
Quoted 6 lines · Jacob Helwig
Quoted 5 lines · Jakub Narebski
Quoted 2 lines · Ketan Padegaonkar
We use http to serve our git repos, in order for git to not ask me a username/password everytime,
Quoted 6 lines
Quoted 3 lines
Errr... WTF? Can't you configure SSH (use ssh-add, perhaps together with tool such as keychain) to use public key based authentication?
I don't think SSH/ssh-agent/pubkey would actually help, given that it's a https URL. Unless I'm missing something here?
I was referring to 'we use http [...] _in order_ for git to not ask me a username/password everywhere'. I just noted that you can make git not ask a username/password everywhere when using ssh:// URLs.
Signature · 2 lines
Jakub Narebski Poland
Quoted 11 lines · Jakub Narebski
Quoted 10 lines · Jacob Helwig
Quoted 8 lines · Jakub Narebski
Quoted 2 lines · Ketan Padegaonkar
We use http to serve our git repos, in order for git to not ask me a username/password everytime,
Errr... WTF? Can't you configure SSH (use ssh-add, perhaps together with tool such as keychain) to use public key based authentication?
Quoted 7 lines
Quoted 2 lines
I don't think SSH/ssh-agent/pubkey would actually help, given that it's a https URL. Unless I'm missing something here?
I was referring to 'we use http [...]
_inorder_for git to not ask me a username/password everywhere'. I just noted that you can make git not ask a username/password everywhere when using ssh:// URLs.
Ah, I read it to mean "We use HTTP. I encode the user and password in the URL to prevent it from asking all the time", not "We use HTTP with an encoded user and password to prevent it from asking". If it's the latter, then you're definitely right: Using SSH + pubkey authentication is probably a _much_ better choice.
Quoted 7 lines · Jacob Helwig
Quoted 6 lines · Jakub Narebski
Quoted 5 lines · Jacob Helwig
Quoted 4 lines · Jakub Narebski
Quoted 2 lines · Ketan Padegaonkar
We use http to serve our git repos, in order for git to not ask me a username/password everytime,
Apologies. I used the wrong punctuation. It should read as:
We use https+basic auth to serve up git repos. Unfortunately SSH is not an option for various reasons.
In order for git to not ask me the username/password, I 'encoded' the username/password into the url.
I'm using git v1.7.1.1 on MacOSX Leopard. I can see the same behavior on master (rev 24e7a5).
Signature · 2 lines
Ketan http://ketan.padegaonkar.name | http://eclipse.org/swtbot
Quoted 6 lines · Ketan Padegaonkar
Quoted 5 lines · Jacob Helwig
Quoted 4 lines · Jakub Narebski
Quoted 3 lines · Jacob Helwig
Quoted 2 lines · Jakub Narebski
Ketan Padegaonkar<[email protected]> writes:
Quoted 7 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
We use http to serve our git repos, in order for git to not ask me a username/password everytime,
Apologies. I used the wrong punctuation. It should read as:
We use https+basic auth to serve up git repos. Unfortunately SSH is not an option for various reasons.
Is it because of firewall, or it is the issue with issuing shell accounts? If the latter, you can use tools such as gitosis or gitolite which need only one single shell account, and control access via public key infrastructure.
Quoted 3 lines
In order for git to not ask me the username/password, I 'encoded' the username/password into the url.
Can't you use ~/.netrc file[1] instead? As far as I see this would not show password info on error. Not that the current situation should not be fixed, but it might be worthwhile workaround for a time.
The ~/.netrc file would look like this for your example:
machine host
login user
password pass
You should of course chmod 600 ~/.netrc
[1] This is unfortunately underdocumented: only this documentation Documentation/howto/setup-git-server-over-http.txt mentions ~/.netrc file. I think that handling the $HOME/.netrc is done by the curl library that git uses, see libcurl-tutorial(3) manpage.
Quoted 2 lines
I'm using git v1.7.1.1 on MacOSX Leopard. I can see the same behavior on master (rev 24e7a5).
Signature · 2 lines
Jakub Narebski Poland
Hi:
Quoted 1 line · Jakub Narebski
Dnia wtorek 20. lipca 2010 01:25, Ketan Padegaonkar napisał:
[snip]
Quoted 10 lines
Can't you use ~/.netrc file[1] instead? As far as I see this would not show password info on error. Not that the current situation should not be fixed, but it might be worthwhile workaround for a time.
The ~/.netrc file would look like this for your example:
machine host
login user
password pass
Quoted 6 lines
You should of course
chmod 600 ~/.netrc[1] This is unfortunately underdocumented: only this documentation
Documentation/howto/setup-git-server-over-http.txtmentions ~/.netrc file. I think that handling the $HOME/.netrc is done by the curl library that git uses, see libcurl-tutorial(3) manpage.
+1
This is the only way I know of to "hide" your password.
Of course, depending on your authentication scheme, your efforts for this setup may prove worthless.
Signature · 2 lines
Cheers, Ray Chuan