Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have started using git for deployment of websites for testing. How do I prevent apache from serving the .git directory contents?

I tried

<Directorymatch "^/.*/\.git/">
Order deny,allow
Deny from all
</Directorymatch>

with no success.

I know that I can create a .htaccess file in each .git directory and deny access, but I wanted something I could put into the main config file that makes this global across all websites.

share|improve this question

7 Answers 7

up vote 22 down vote accepted

It's not because you have 'svn' and not 'git' in the rule is it?

<Directorymatch "^/.*/\.git/">
Order deny,allow
Deny from all
</Directorymatch>
share|improve this answer
1  
When I create a .htaccess containing only your code, I get the error: "<DirectoryMatch not allowed here" –  Shoan Jul 27 '10 at 19:03
    
It has to be in the Apache conf. See: httpd.apache.org/docs/1.3/mod/core.html#directorymatch –  sinping Jul 28 '10 at 12:45

If you don't use .htaccess files but instead want to use /etc/apache2/httpd.conf (or whatever your server's master conf file is) to hide both .git directories and .gitignore files, you can use the following. I found the answer above for master conf setting did not hide the gitignore file.

# do not allow .git version control files to be issued
<Directorymatch "^/.*/\.git+/">
  Order deny,allow
  Deny from all
</Directorymatch>
<Files ~ "^\.git">
    Order allow,deny
    Deny from all 
</Files>
share|improve this answer

If you're on a shared hosting service and don't have access to apache.conf, you can still do it in your .htaccess file, like this:

RewriteEngine On
RewriteRule "^(.*/)?\.git/" - [F,L]
share|improve this answer
    
thanks this worked for me in a shared hosting situation where the top answer didn't –  Plato Oct 1 at 23:34

This has the same effect as many of the other answers but is much simpler:

RedirectMatch 404 /\.git

This can go into .htaccess or your server config file. It hides any file or directory whose name begins with .git (e.g. a .git directory or .gitignore file) by returning a 404. So not only are the contents of your Git repo hidden, its very existence is hidden too.

share|improve this answer
    
I really like this solution. It's simple and elegant. –  Shoan Mar 8 at 9:02

To protect both the .git directory as well as other files such as .gitignore and .gitmodules using .htaccess, use:

RewriteEngine On
RewriteRule ^(.*/)?\.git+ - [F,L]
ErrorDocument 403 "Access Forbidden"
share|improve this answer
2  
Does work for me, however the trailing ErrorDocument has no impact. From a security angle, I'd fancy a bogus 404 over an informative 403 to the attacker... –  Fronker May 26 '13 at 10:01
    
This is a bad idea, because it discloses information to hackers. A 403 means it's there, a 404 means it's not. Every fact on a server's setup is usefull to a hacker. I'd consider revising this. –  GerardJP Dec 10 at 10:25
### never deliver .git folders, .gitIgnore
RewriteRule ^(.*/)?\.git+ - [R=404,L]

# 2nd line of defense (if no mod_rewrite)
RedirectMatch 404 ^(.*/)?\.git+

This works in .htaccess, no http.conf access required. Include this as the first of rewrite rules. Prepend Rewrite On if needed.

From a security angle, I prefer a bogus 404 over an 403, more informative to the attacker. Comment one of the two out, to ensure, the other works for you, too.

Btw, good changes are, your lithmus test for the two are:

http://localhost/.gitignore
http://localhost/.git/HEAD
share|improve this answer
    
Why have both rules? The simpler RedirectMatch suffices on its own. (Also, the regexes don't seem quite right -- why the plus on the end?) –  Bennett McElwee Aug 1 '13 at 10:20
    
Personal Paranoia / doubled security. If RewriteEngine happens to get turned off (central config changes, poor team communication, unlucky server "update",... you name it :-) The + is obsolete or should be a $, good point! (no time for testing, sorry.) –  Fronker Aug 2 '13 at 12:24
    
If you're worried that RewriteEngine might be off, just put RewriteEngine On before your RewriteRule. But anyhow it is tautological and redundant because the simpler RedirectMatch suffices on its own. Though even that could be simplified. Basically I am recommending my answer instead. :) –  Bennett McElwee Aug 3 '13 at 4:51
    
+1 for the litmus test. –  Shawn Strickland Jul 15 at 14:58

Assuming your webserver is using a different user than the one you use to access the .git repository, you could disable the execute bit for others on the .git directory.

This should work with other webservers and doesn't rely on performance-consuming .htaccess files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.