Server Config on Github Security Considerations?

Question

What are the security considerations of having my server configs in a repo on Github with world read-only access. I know to not include /etc/shadow and other password files. I'd like to share any of my good ideas and allow others to contribute, but I don't want to roll out a welcome mat for crackers.

Answer 1

Generally speaking I wouldn't post my server configs anywhere outside my organization (though internally they are in git).

If you want to share your ideas the best thing you can do is write a whitepaper or howto with sanitized pieces of the relevant configuration files (using the domains & address ranges reserved for examples is always nice too). If you & others find it particularly valuable a USENIX/LISA presentation is certainly not out of the realm of possibility either.

Doing it this way has a few advantages:

• From the standpoint of someone looking to solve a specific problem it does 90% of the work for me: I don't have to pick through your whole system configuration to sort out what bits are relevant to me and what I don't care about or is specifically tied to your environment.
  
  
• From a security standpoint it lets you share your knowledge/ideas and get feedback while protecting you from exposing details about your environment which could be useful to potential intruders (not that you can't accidentally post a useful tidbit in a sanitized file, but they won't have the whole picture).