CODEWITHSUNDEEP
git.htaccessapache2
Chris Muench
Chris Muench

Reputation: 18338

Make .git directory web inaccessible

I have a website that I use github (closed source) to track changes and update site. The only problem is, it appears the .git directory is accessible via the web. How can I stop this and still be able to use git?

Should I use .htaccess? Should I change permissions of .git?

Upvotes: 169

Views: 78770

Answers (9)

Abhi
Abhi

Reputation: 119

solution for apache2 (LAMP) server - you have 2 places to add .htaccess contents.. if 1 fails, try next

  1. for (development environment)

create .htaccess file in /var/www/html root directory and paste the code inside it

<Directorymatch "^/.*/\.git/">
  Order 'deny,allow'
  Deny from all
</Directorymatch>
  1. for (Production environment)

inside virtual host file (/etc/apache2/sites-enabled/) >find your virtualhost file> open file > after closing of virtualhost tag, paste

<Directorymatch "^/.*/\.git/">
  Order 'deny,allow'
  Deny from all
</Directorymatch>

no need to restart the server, it runs when page is called upon

Upvotes: 2

Javier Larroulet
Javier Larroulet

Reputation: 3237

Instead of messing with .htaccess rules like most answers suggest, why not simply put the .git/ directory above the webroot?

In my setups, my .git directory usually lives in something like:

/home/web/project_name/.git/

My actual code lives in

/home/web/project_name/www_root/

since my web root (as defined on Apache or Nginx.. I prefer the latter) is /home/web/project_name/www_root/ there's no way the .git directory can be accessible from the web since it lives "higher" than the webroot

Upvotes: 2

ThiefMaster
ThiefMaster

Reputation: 318688

Create a .htaccess file in the .git folder and put the following in this file:

Order allow,deny
Deny from all

But note, that it would be lost if you ever re-cloned the repository

Upvotes: 48

Jake Wharton
Jake Wharton

Reputation: 76115

Both .htaccess and permissions on the .git/ folder would work. I recommend the former:

<Directory .git>
    order allow,deny
    deny from all
</Directory>

Upvotes: 37

user1270496
user1270496

Reputation:

I'm not comfortable with controlling access to my .git folders individually and choose to do it via apache config instead of .htaccess, to prevent me overwriting them, or forgetting on a new install etc.

Here are some detailed instructions hope they help. I'm using Ubuntu 16.10.

  1. First check what happens if you navigate to the .git folder in a browser. In my case I was presented with a directory listing. If you are seeing what you shouldn't be seeing (ie. you're not getting a 404), do the following.
  2. Use apache2ctl -V to get the HTTPD_ROOT and SERVER_CONFIG_FILE
  3. Use this to edit your apache config, in my case $ sudo nano /etc/apache2/apache2.conf
  4. Add the following somewhere in the config file: RedirectMatch 404 /.git
  5. Restart apache: $ sudo service apache2 restart
  6. Should now get you a 404 if you navigate to the folder again
  7. I tried this with .gitignore and also got a 404

Upvotes: 10

hailong
hailong

Reputation: 1525

A more robust and simple option would be disabling the READ and Execution permission of the .git directory.

Since mostly Apache (httpd) runs under a special user account, for example, it runs as user apache on CentOS, while the .git directory must be created under a real user account, so we can simply block the access by changing the permission. Moreover, this approach doesn't introduce any new file, nor affect the git commands.

The command can be:

chmod -R o-rx .git

Upvotes: 9

David Moles
David Moles

Reputation: 51169

I didn't want to muck around in the .git directory and wasn't able to get Bennett's solution to work on Apache 2.2, but adding the following to my <VirtualHost> configuration worked:

RewriteRule ^.*\.git.* - [R=404]

Upvotes: 19

Bennett McElwee
Bennett McElwee

Reputation: 25800

Put this in an .htaccess file at the root of your web server:

RedirectMatch 404 /\.git

This solution is robust and secure: it

  • works for all .git directories in your site, even if there are more than one,
  • also hides other Git files like .gitignore and .gitmodules
  • works even for newly-added .git directories, and
  • doesn't even give away the fact that the directories exist.

Upvotes: 478

Kosh
Kosh

Reputation: 85

mod_rewrite will give you the desired affect:

RewriteEngine on
RewriteRule .*\.git/.* - [F]

Upvotes: 6

Related Questions