[SECURITY] .git, .svn, and .hg

[Brian Loomis-3]

I became aware of an exploit that pertains to using version control  
and wanted to post an update to my version control webinar.

If you are using version control you need to take care to secure these  
directories from Apache, it's not enough to just have directory access  
turned off, you need to explicitly disallow these ( or all . )  
depending on your setup but to protect version control you should add  
the following to the site.conf file (or the whole httpd.conf) in Apache:

   # Disallow viewing of .svn and .git and .hg directory contents
   <Directory ~ \.(svn|git|hg)>
     Order allow,deny
     Deny from all
   </Directory>

This resolved an issue I discovered where .git/config is viewable  
revealing config information used to assign blame and format patches.

This is crucial for .svn as subversion creates multiple .svn files in  
every node of a repository.

Brian Loomis
http://www.virtualrelations.us
[phone] - 208 NEW BLOX
-- email checked daily --


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Brian Loomis-3]

I haven't tested this because I'm not using svn but I think my post  
may will not wildcard for  *.svn.

Can anyone concur?

On Oct 28, 2009, at 12:36 PM, Brian Loomis wrote:

> I became aware of an exploit that pertains to using version control  
> and wanted to post an update to my version control webinar.
>
> If you are using version control you need to take care to secure  
> these directories from Apache, it's not enough to just have  
> directory access turned off, you need to explicitly disallow these  
> ( or all . ) depending on your setup but to protect version control  
> you should add the following to the site.conf file (or the whole  
> httpd.conf) in Apache:
>
>  # Disallow viewing of .svn and .git and .hg directory contents
>  <Directory ~ \.(svn|git|hg)>
>    Order allow,deny
>    Deny from all
>  </Directory>
>
> This resolved an issue I discovered where .git/config is viewable  
> revealing config information used to assign blame and format patches.
>
> This is crucial for .svn as subversion creates multiple .svn files  
> in every node of a repository.
>
> Brian Loomis
> http://www.virtualrelations.us
> [phone] - 208 NEW BLOX
> -- email checked daily --
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>

Brian Loomis
http://www.virtualrelations.us
[phone] - 208 NEW BLOX
-- email checked daily --


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Brad Lindsay-2]

Of course it would happen that my (and MySQL's) favorite version  
control system would get left off the list :-)

This applies for Bazaar as well (.bzr)

Thanks Brian!
-Brad




On Oct 28, 2009, at 2:36 PM, Brian Loomis wrote:

> I became aware of an exploit that pertains to using version control  
> and wanted to post an update to my version control webinar.
>
> If you are using version control you need to take care to secure  
> these directories from Apache, it's not enough to just have  
> directory access turned off, you need to explicitly disallow these  
> ( or all . ) depending on your setup but to protect version control  
> you should add the following to the site.conf file (or the whole  
> httpd.conf) in Apache:
>
>  # Disallow viewing of .svn and .git and .hg directory contents
>  <Directory ~ \.(svn|git|hg)>
>    Order allow,deny
>    Deny from all
>  </Directory>
>
> This resolved an issue I discovered where .git/config is viewable  
> revealing config information used to assign blame and format patches.
>
> This is crucial for .svn as subversion creates multiple .svn files  
> in every node of a repository.
>
> Brian Loomis
> http://www.virtualrelations.us
> [phone] - 208 NEW BLOX
> -- email checked daily --
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>
>

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Brian Loomis-3]

Adjusted

   # Disallow viewing of .svn and .git and .hg and .bzr directory  
contents
   <Directory ~ \.(svn|git|hg|bzr)>
     Order allow,deny
     Deny from all
   </Directory>

On Oct 28, 2009, at 12:47 PM, Brad Lindsay wrote:

> Of course it would happen that my (and MySQL's) favorite version  
> control system would get left off the list :-)
>
> This applies for Bazaar as well (.bzr)
>
> Thanks Brian!
> -Brad
>
>
>
>
> On Oct 28, 2009, at 2:36 PM, Brian Loomis wrote:
>
>> I became aware of an exploit that pertains to using version control  
>> and wanted to post an update to my version control webinar.
>>
>> If you are using version control you need to take care to secure  
>> these directories from Apache, it's not enough to just have  
>> directory access turned off, you need to explicitly disallow these  
>> ( or all . ) depending on your setup but to protect version control  
>> you should add the following to the site.conf file (or the whole  
>> httpd.conf) in Apache:
>>
>> # Disallow viewing of .svn and .git and .hg directory contents
>> <Directory ~ \.(svn|git|hg)>
>>   Order allow,deny
>>   Deny from all
>> </Directory>
>>
>> This resolved an issue I discovered where .git/config is viewable  
>> revealing config information used to assign blame and format patches.
>>
>> This is crucial for .svn as subversion creates multiple .svn files  
>> in every node of a repository.
>>
>> Brian Loomis
>> http://www.virtualrelations.us
>> [phone] - 208 NEW BLOX
>> -- email checked daily --
>>
>>
>> --
>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>
>>
>>
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>

Brian Loomis
http://www.virtualrelations.us
[phone] - 208 NEW BLOX
-- email checked daily --


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Eric Landmann]

On 10/28/09 at 1:43 PM, brian@... (Brian Loomis) wrote:

> I haven't tested this because I'm not using svn but I think my post may will not wildcard for  
> *.svn.

This rule works for .svn directories:

# Disallow .svn directory and contents
<Directory ~ \.(svn)>
    Order allow,deny
    Deny from all
</Directory>

--Eric


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Brad Lindsay-2]

Brian,
I just implemented this on one of my servers, but it's not working.  I  
can still access my .bzr folder and items therein.  I've tried putting  
the Directory inside my virtual host directive as well as having it  
outside.  Apache restarts just fine with no errors that I can see, but  
access to those folders isn't blocked.  Any ideas?

-Brad


On Oct 28, 2009, at 2:50 PM, Brian Loomis wrote:

> Adjusted
>
>  # Disallow viewing of .svn and .git and .hg and .bzr directory  
> contents
>  <Directory ~ \.(svn|git|hg|bzr)>
>    Order allow,deny
>    Deny from all
>  </Directory>
>
> On Oct 28, 2009, at 12:47 PM, Brad Lindsay wrote:
>
>> Of course it would happen that my (and MySQL's) favorite version  
>> control system would get left off the list :-)
>>
>> This applies for Bazaar as well (.bzr)
>>
>> Thanks Brian!
>> -Brad
>>
>>
>>
>>
>> On Oct 28, 2009, at 2:36 PM, Brian Loomis wrote:
>>
>>> I became aware of an exploit that pertains to using version  
>>> control and wanted to post an update to my version control webinar.
>>>
>>> If you are using version control you need to take care to secure  
>>> these directories from Apache, it's not enough to just have  
>>> directory access turned off, you need to explicitly disallow these  
>>> ( or all . ) depending on your setup but to protect version  
>>> control you should add the following to the site.conf file (or the  
>>> whole httpd.conf) in Apache:
>>>
>>> # Disallow viewing of .svn and .git and .hg directory contents
>>> <Directory ~ \.(svn|git|hg)>
>>>  Order allow,deny
>>>  Deny from all
>>> </Directory>
>>>
>>> This resolved an issue I discovered where .git/config is viewable  
>>> revealing config information used to assign blame and format  
>>> patches.
>>>
>>> This is crucial for .svn as subversion creates multiple .svn files  
>>> in every node of a repository.
>>>
>>> Brian Loomis
>>> http://www.virtualrelations.us
>>> [phone] - 208 NEW BLOX
>>> -- email checked daily --
>>>
>>>
>>> --
>>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>>
>>>
>>>
>>
>>
>> --
>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>
>>
>
> Brian Loomis
> http://www.virtualrelations.us
> [phone] - 208 NEW BLOX
> -- email checked daily --
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>
>

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Brad Lindsay-2]

Apparently it's an issue with Lasso 9 and not your Apache directive.

-Brad

On Oct 28, 2009, at 3:29 PM, Brad Lindsay wrote:

> Brian,
> I just implemented this on one of my servers, but it's not working.  
> I can still access my .bzr folder and items therein.  I've tried  
> putting the Directory inside my virtual host directive as well as  
> having it outside.  Apache restarts just fine with no errors that I  
> can see, but access to those folders isn't blocked.  Any ideas?
>
> -Brad
>
>
> On Oct 28, 2009, at 2:50 PM, Brian Loomis wrote:
>
>> Adjusted
>>
>> # Disallow viewing of .svn and .git and .hg and .bzr directory  
>> contents
>> <Directory ~ \.(svn|git|hg|bzr)>
>>   Order allow,deny
>>   Deny from all
>> </Directory>
>>
>> On Oct 28, 2009, at 12:47 PM, Brad Lindsay wrote:
>>
>>> Of course it would happen that my (and MySQL's) favorite version  
>>> control system would get left off the list :-)
>>>
>>> This applies for Bazaar as well (.bzr)
>>>
>>> Thanks Brian!
>>> -Brad
>>>
>>>
>>>
>>>
>>> On Oct 28, 2009, at 2:36 PM, Brian Loomis wrote:
>>>
>>>> I became aware of an exploit that pertains to using version  
>>>> control and wanted to post an update to my version control webinar.
>>>>
>>>> If you are using version control you need to take care to secure  
>>>> these directories from Apache, it's not enough to just have  
>>>> directory access turned off, you need to explicitly disallow  
>>>> these ( or all . ) depending on your setup but to protect version  
>>>> control you should add the following to the site.conf file (or  
>>>> the whole httpd.conf) in Apache:
>>>>
>>>> # Disallow viewing of .svn and .git and .hg directory contents
>>>> <Directory ~ \.(svn|git|hg)>
>>>> Order allow,deny
>>>> Deny from all
>>>> </Directory>
>>>>
>>>> This resolved an issue I discovered where .git/config is viewable  
>>>> revealing config information used to assign blame and format  
>>>> patches.
>>>>
>>>> This is crucial for .svn as subversion creates multiple .svn  
>>>> files in every node of a repository.
>>>>
>>>> Brian Loomis
>>>> http://www.virtualrelations.us
>>>> [phone] - 208 NEW BLOX
>>>> -- email checked daily --
>>>>
>>>>
>>>> --
>>>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>>>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>>>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>>>
>>>>
>>>>
>>>
>>>
>>> --
>>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>>
>>>
>>
>> Brian Loomis
>> http://www.virtualrelations.us
>> [phone] - 208 NEW BLOX
>> -- email checked daily --
>>
>>
>> --
>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>
>>
>>
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>
>
>

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Brian Loomis-3]

what version of apache are you using?

I was using 1.3 with that.  I have not tested it on 2.x

On Oct 28, 2009, at 1:29 PM, Brad Lindsay wrote:

> Brian,
> I just implemented this on one of my servers, but it's not working.  
> I can still access my .bzr folder and items therein.  I've tried  
> putting the Directory inside my virtual host directive as well as  
> having it outside.  Apache restarts just fine with no errors that I  
> can see, but access to those folders isn't blocked.  Any ideas?
>
> -Brad
>
>
> On Oct 28, 2009, at 2:50 PM, Brian Loomis wrote:
>
>> Adjusted
>>
>> # Disallow viewing of .svn and .git and .hg and .bzr directory  
>> contents
>> <Directory ~ \.(svn|git|hg|bzr)>
>>   Order allow,deny
>>   Deny from all
>> </Directory>
>>
>> On Oct 28, 2009, at 12:47 PM, Brad Lindsay wrote:
>>
>>> Of course it would happen that my (and MySQL's) favorite version  
>>> control system would get left off the list :-)
>>>
>>> This applies for Bazaar as well (.bzr)
>>>
>>> Thanks Brian!
>>> -Brad
>>>
>>>
>>>
>>>
>>> On Oct 28, 2009, at 2:36 PM, Brian Loomis wrote:
>>>
>>>> I became aware of an exploit that pertains to using version  
>>>> control and wanted to post an update to my version control webinar.
>>>>
>>>> If you are using version control you need to take care to secure  
>>>> these directories from Apache, it's not enough to just have  
>>>> directory access turned off, you need to explicitly disallow  
>>>> these ( or all . ) depending on your setup but to protect version  
>>>> control you should add the following to the site.conf file (or  
>>>> the whole httpd.conf) in Apache:
>>>>
>>>> # Disallow viewing of .svn and .git and .hg directory contents
>>>> <Directory ~ \.(svn|git|hg)>
>>>> Order allow,deny
>>>> Deny from all
>>>> </Directory>
>>>>
>>>> This resolved an issue I discovered where .git/config is viewable  
>>>> revealing config information used to assign blame and format  
>>>> patches.
>>>>
>>>> This is crucial for .svn as subversion creates multiple .svn  
>>>> files in every node of a repository.
>>>>
>>>> Brian Loomis
>>>> http://www.virtualrelations.us
>>>> [phone] - 208 NEW BLOX
>>>> -- email checked daily --
>>>>
>>>>
>>>> --
>>>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>>>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>>>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>>>
>>>>
>>>>
>>>
>>>
>>> --
>>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>>
>>>
>>
>> Brian Loomis
>> http://www.virtualrelations.us
>> [phone] - 208 NEW BLOX
>> -- email checked daily --
>>
>>
>> --
>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>
>>
>>
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>

Brian Loomis
http://www.virtualrelations.us
[phone] - 208 NEW BLOX
-- email checked daily --


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Eric Landmann]

On 10/28/09 at 2:34 PM, brian@... (Brian Loomis) wrote:

>what version of apache are you using?
>I was using 1.3 with that.  I have not tested it on 2.x

The rule I posted for .svn is working on Apache 2.2.11 on Mac OS
X Server 10.5.8. It's inside of a virtual host configuration.

--Eric


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Eric Landmann]

> On 10/28/09 at 2:34 PM, brian@... (Brian Loomis) wrote:
>
> >what version of apache are you using?
> >I was using 1.3 with that.  I have not tested it on 2.x
>
> The rule I posted for .svn is working on Apache 2.2.11 on Mac OS X Server 10.5.8. It's inside of a
> virtual host configuration.

You can test to see if it works by hitting either the directory, or any file in it, e.g.:

http://www.yoursite.com/.svn/entries

--Eric


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[bilcorry]

Brian Loomis wrote on 10/28/2009 11:36 AM:
> This resolved an issue I discovered where .git/config is viewable
> revealing config information used to assign blame and format patches.
>
> This is crucial for .svn as subversion creates multiple .svn files in
> every node of a repository.

I use this to block any path where a component begins with underscore or a period(e.g. /.svn, /hello/_world/, /_secret.lasso, etc...):

    # Block serving files and folders starting with underscore or period
    RewriteCond %{REQUEST_URI}  !^/.well-known/.*$
    RewriteRule (^|/)(_|\.).*$  - [L,NS,F]

The first conditional excludes /.well-known/, which you can read about here:

        http://tools.ietf.org/html/draft-nottingham-site-meta


- Bil


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[bilcorry]

Brian Loomis wrote on 10/28/2009 11:36 AM:
> This resolved an issue I discovered where .git/config is viewable
> revealing config information used to assign blame and format patches.

Opps, meant to pass along this too:

        Basic Flaw Reveals Source Code to 3,300 Popular Websites
        http://www.techcrunch.com/2009/09/23/basic-flaw-reveals-source-code-to-3300-popular-websites/


- Bil


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Steve Piercy]

On 10/28/09 at 11:06 PM, bil@... (Bil Corry) pronounced:

>Brian Loomis wrote on 10/28/2009 11:36 AM:
>>This resolved an issue I discovered where .git/config is viewable
>>revealing config information used to assign blame and format patches.
>>
>>This is crucial for .svn as subversion creates multiple .svn files in
>>every node of a repository.
>
>I use this to block any path where a component begins with
>underscore or a period(e.g. /.svn, /hello/_world/,
>/_secret.lasso, etc...):
>
># Block serving files and folders starting with underscore or period
>RewriteCond %{REQUEST_URI}  !^/.well-known/.*$
>RewriteRule (^|/)(_|\.).*$  - [L,NS,F]
>
>The first conditional excludes /.well-known/, which you can read about here:
>
>http://tools.ietf.org/html/draft-nottingham-site-meta

What is the relevance to /.well-known/ in this context?  Is it
just a way to match everything, but avoid whatever has been
registered as "/.well-known/"?

Does your RewriteRule say:

For matching requested URIs, rewrite anything that begins with
[nothing(?not sure?)] or a /, followed by _ or ., followed by
any number of characters, followed by the end of the URI,
performing no substitution, then making this RewriteRule the
Last, with No Subrequests, and return Forbidden?

--steve

-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
-- --
Steve Piercy               Web Site Builder              
Soquel, CA
<web@...>                  <http://www.StevePiercy.com/>


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[bilcorry]

Steve Piercy - Web Site Builder wrote on 10/29/2009 1:10 AM:

> On 10/28/09 at 11:06 PM, bil@... (Bil Corry) pronounced:
>
>> Brian Loomis wrote on 10/28/2009 11:36 AM:
>>> This resolved an issue I discovered where .git/config is viewable
>>> revealing config information used to assign blame and format patches.
>>>
>>> This is crucial for .svn as subversion creates multiple .svn files in
>>> every node of a repository.
>>
>> I use this to block any path where a component begins with underscore
>> or a period(e.g. /.svn, /hello/_world/, /_secret.lasso, etc...):
>>
>> # Block serving files and folders starting with underscore or period
>> RewriteCond %{REQUEST_URI}  !^/.well-known/.*$
>> RewriteRule (^|/)(_|\.).*$  - [L,NS,F]
>>
>> The first conditional excludes /.well-known/, which you can read about
>> here:
>>
>> http://tools.ietf.org/html/draft-nottingham-site-meta
>
> What is the relevance to /.well-known/ in this context?  Is it just a
> way to match everything, but avoid whatever has been registered as
> "/.well-known/"?

Yes.  If you know you will never use /.well-known/ then you can omit that conditional.  Or add it later if you ever do use it.


> Does your RewriteRule say:
>
> For matching requested URIs, rewrite anything that begins with
> [nothing(?not sure?)] or a /, followed by _ or ., followed by any number
> of characters, followed by the end of the URI, performing no
> substitution, then making this RewriteRule the Last, with No
> Subrequests, and return Forbidden?

Apache evals the rewriterule first, so it compares the request to the regex, in this case "if the start of a request OR a directory slash is followed by an underscore or period followed by anything, then match".  Then Apache uses rewritecond to futher evaluate, and it says "if the request does NOT begin with /.well-known/, then match".  The flags L,NS,F tell it to not match on internal request, and to return FAIL to the browser.


- Bil


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Pier Kuipers]

Thanks for pointing that out, Brian. Big scary moment!

Pier

On Wed, Oct 28, 2009 at 6:36 PM, Brian Loomis <brian@...> wrote:

> I became aware of an exploit that pertains to using version control and
> wanted to post an update to my version control webinar.
>
> If you are using version control you need to take care to secure these
> directories from Apache, it's not enough to just have directory access
> turned off, you need to explicitly disallow these ( or all . ) depending on
> your setup but to protect version control you should add the following to
> the site.conf file (or the whole httpd.conf) in Apache:
>
>  # Disallow viewing of .svn and .git and .hg directory contents
>  <Directory ~ \.(svn|git|hg)>
>    Order allow,deny
>    Deny from all
>  </Directory>
>
> This resolved an issue I discovered where .git/config is viewable revealing
> config information used to assign blame and format patches.
>
> This is crucial for .svn as subversion creates multiple .svn files in every
> node of a repository.
>
> Brian Loomis
> http://www.virtualrelations.us
> [phone] - 208 NEW BLOX
> -- email checked daily --
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>
>

--
Pier Kuipers
Visual ID
Unit S02
Synergy Centre
ITT Tallaght
Dublin 24
Ireland
Tel. [phone]
Mobile [phone]
Web http://www.visualid.com

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Pier Kuipers]

I was trying to be clever and added that directive to
/etc/apache2/sites/virtual_hosts_global.conf
That worked for all my vhosts, but unfortunately the Server Admin GUI
overwrites the file when you make a change to your configuration.
So it looks like I'll have to add this to each Vhost separately...

Pier


On Wed, Oct 28, 2009 at 7:25 PM, Eric Landmann
<elandmann@...> wrote:

> On 10/28/09 at 1:43 PM, brian@... (Brian Loomis) wrote:
>
>> I haven't tested this because I'm not using svn but I think my post may will not wildcard for
>> *.svn.
>
> This rule works for .svn directories:
>
> # Disallow .svn directory and contents
> <Directory ~ \.(svn)>
>    Order allow,deny
>    Deny from all
> </Directory>
>
> --Eric
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>
>

--
Pier Kuipers
Visual ID
Unit S02
Synergy Centre
ITT Tallaght
Dublin 24
Ireland
Tel. [phone]
Mobile [phone]
Web http://www.visualid.com

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/