{"thread":{"id":"17126","subject":"git/webdav is refusing to authenticate properly.","startedAt":"2009-01-12T21:54:22Z","lastAt":"2009-01-13T18:20:30Z","messageCount":6,"participants":["Peter Spierenburg","Johannes Schindelin","Boyd Stephen Smith Jr."],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"100176","messageId":"137c54e10901121354l284f11ag675abb003fc83e93@mail.gmail.com","threadId":"17126","inReplyTo":null,"subject":"git/webdav is refusing to authenticate properly.","fromName":"Peter Spierenburg","fromEmail":"ionlyusethisaddressforlists@gmail.com","sentAt":"2009-01-12T21:54:22Z","receivedAt":"2009-01-12T21:54:22Z","isPatch":false,"sender":{"key":"ionlyusethisaddressforlists@gmail.com","avatar":null},"body":"Greetings,\n\nI'm trying to push a local git repository to a remote site using\nWebDAV, but it is eating my lunch.\n\nMy first attempt includes a username but no password in the url:\n\n$ git-config remote.upload.url\nhttp://peter@spierepf.dyndns.org/git/ToastMeister.git/\n$ git push upload master\nFetching remote heads...\n refs/\n refs/tags/\n refs/heads/\nupdating 'refs/heads/master'\n from 0000000000000000000000000000000000000000\n to 0f5f3df5e289b5696d7319dcfabc2383192f306a\nUnable to create branch path\nhttp://peter@spierepf.dyndns.org/git/ToastMeister.git/refs\nUnable to lock remote branch refs/heads/master\nerror: failed to push some refs to\n'http://peter@spierepf.dyndns.org/git/ToastMeister.git/'\n\nWhat surprises me here is that git never asks for a password, so\nnaturally, my apache webserver will refuse the request:\n\n==> /var/log/apache2/access.log <==\n208.38.1.1 - - [12/Jan/2009:11:52:07 -0700] \"PROPFIND\n/git/ToastMeister.git/ HTTP/1.1\" 207 569 \"-\" \"git/1.5.6.3\"\n208.38.1.1 - - [12/Jan/2009:11:52:08 -0700] \"HEAD\n/git/ToastMeister.git/info/refs HTTP/1.1\" 404 - \"-\" \"git/1.5.6.3\"\n208.38.1.1 - - [12/Jan/2009:11:52:08 -0700] \"HEAD\n/git/ToastMeister.git/objects/info/packs HTTP/1.1\" 404 - \"-\"\n\"git/1.5.6.3\"\n\n==> /var/log/apache2/error.log <==\n[Mon Jan 12 11:52:08 2009] [error] [client 208.38.1.1] File does not\nexist: /var/www/git/ToastMeister.git/info/refs\n[Mon Jan 12 11:52:08 2009] [error] [client 208.38.1.1] File does not\nexist: /var/www/git/ToastMeister.git/objects/info/packs\n\n==> /var/log/apache2/access.log <==\n208.38.1.1 - - [12/Jan/2009:11:52:08 -0700] \"PROPFIND\n/git/ToastMeister.git/refs/ HTTP/1.1\" 207 2587 \"-\" \"git/1.5.6.3\"\n208.38.1.1 - - [12/Jan/2009:11:52:08 -0700] \"PROPFIND\n/git/ToastMeister.git/refs/tags/ HTTP/1.1\" 207 933 \"-\" \"git/1.5.6.3\"\n208.38.1.1 - - [12/Jan/2009:11:52:08 -0700] \"PROPFIND\n/git/ToastMeister.git/refs/heads/ HTTP/1.1\" 207 934 \"-\" \"git/1.5.6.3\"\n208.38.1.1 - peter [12/Jan/2009:11:52:08 -0700] \"MKCOL\n/git/ToastMeister.git/refs HTTP/1.1\" 401 598 \"-\" \"git/1.5.6.3\"\n\n==> /var/log/apache2/error.log <==\n[Mon Jan 12 11:52:08 2009] [warn] [client 208.38.1.1] [12697]\nauth_ldap authenticate: user peter authentication failed; URI\n/git/ToastMeister.git/refs [Empty password not allowed][Invalid\ncredentials]\n[Mon Jan 12 11:52:08 2009] [error] [client 208.38.1.1] user peter:\nauthentication failure for \"/git/ToastMeister.git/refs\": Password\nMismatch\n\nSo next, I'll try adding a password to the URL:\n\n$ git-config remote.upload.url\nhttp://peter:@spierepf.dyndns.org/git/ToastMeister.git/\n$ git push upload master\nFetching remote heads...\n refs/\n refs/tags/\n refs/heads/\nupdating 'refs/heads/master'\n from 0000000000000000000000000000000000000000\n to 0f5f3df5e289b5696d7319dcfabc2383192f306a\nUnable to create branch path\nhttp://peter:@spierepf.dyndns.org/git/ToastMeister.git/refs\nUnable to lock remote branch refs/heads/master\nerror: failed to push some refs to\n'http://peter:@spierepf.dyndns.org/git/ToastMeister.git/'\n\n>From the client side, the result appears identical, but on the server:\n\n==> /var/log/apache2/access.log <==\n208.38.1.1 - - [12/Jan/2009:11:52:50 -0700] \"PROPFIND\n/git/ToastMeister.git/ HTTP/1.1\" 207 581 \"-\" \"git/1.5.6.3\"\n208.38.1.1 - - [12/Jan/2009:11:52:50 -0700] \"HEAD\n/git/ToastMeister.git/info/refs HTTP/1.1\" 404 - \"-\" \"git/1.5.6.3\"\n208.38.1.1 - - [12/Jan/2009:11:52:51 -0700] \"HEAD\n/git/ToastMeister.git/objects/info/packs HTTP/1.1\" 404 - \"-\"\n\"git/1.5.6.3\"\n\n==> /var/log/apache2/error.log <==\n[Mon Jan 12 11:52:50 2009] [error] [client 208.38.1.1] File does not\nexist: /var/www/git/ToastMeister.git/info/refs\n[Mon Jan 12 11:52:51 2009] [error] [client 208.38.1.1] File does not\nexist: /var/www/git/ToastMeister.git/objects/info/packs\n\n==> /var/log/apache2/access.log <==\n208.38.1.1 - - [12/Jan/2009:11:52:51 -0700] \"PROPFIND\n/git/ToastMeister.git/refs/ HTTP/1.1\" 207 2587 \"-\" \"git/1.5.6.3\"\n208.38.1.1 - - [12/Jan/2009:11:52:51 -0700] \"PROPFIND\n/git/ToastMeister.git/refs/tags/ HTTP/1.1\" 207 933 \"-\" \"git/1.5.6.3\"\n208.38.1.1 - - [12/Jan/2009:11:52:51 -0700] \"PROPFIND\n/git/ToastMeister.git/refs/heads/ HTTP/1.1\" 207 934 \"-\" \"git/1.5.6.3\"\n208.38.1.1 - peter [12/Jan/2009:11:52:51 -0700] \"MKCOL\n/git/ToastMeister.git/refs HTTP/1.1\" 301 458 \"-\" \"git/1.5.6.3\"\n208.38.1.1 - - [12/Jan/2009:11:52:51 -0700] \"MKCOL\n/git/ToastMeister.git/refs/ HTTP/1.1\" 401 598 \"-\" \"git/1.5.6.3\"\n\nIt looks like the client is attempting to create a collection that\nalready exists, gets redirected (301 - Moved Permanently), forgets to\nauthenticate on the next request, gets denied (401 - Unauthorized),\nand gives up.\n\nAny idea why this is happening?\n\nPeter-Frank Spierenburg.\n"},{"id":"100191","messageId":"alpine.DEB.1.00.0901130003490.3586@pacific.mpi-cbg.de","threadId":"17126","inReplyTo":"137c54e10901121354l284f11ag675abb003fc83e93@mail.gmail.com","subject":"Re: git/webdav is refusing to authenticate properly.","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2009-01-12T23:04:42Z","receivedAt":"2009-01-12T23:04:42Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Mon, 12 Jan 2009, Peter Spierenburg wrote:\n\n> I'm trying to push a local git repository to a remote site using WebDAV, \n> but it is eating my lunch.\n\nPlease see Documentation/howto/setup-git-server-over-http.txt.\n\nIn short, http-push does not ask for a password interactively, but you \nhave to use .netrc.\n\nHth,\nDscho\n"},{"id":"100208","messageId":"496BE1E0.9010908@gmail.com","threadId":"17126","inReplyTo":"alpine.DEB.1.00.0901130003490.3586@pacific.mpi-cbg.de","subject":"Re: git/webdav is refusing to authenticate properly.","fromName":"Peter Spierenburg","fromEmail":"ionlyusethisaddressforlists@gmail.com","sentAt":"2009-01-13T00:35:44Z","receivedAt":"2009-01-13T00:35:44Z","isPatch":false,"sender":{"key":"ionlyusethisaddressforlists@gmail.com","avatar":null},"body":"C'mon, leave my password 'in-the-clear', in a text file on a networked \nbox? That is the kind of prank a fourth-year student would try to pull \non a freshman.\n\nHow do I really do it?\n\nPeter.\n\n\nJohannes Schindelin wrote:\n> Hi,\n>\n> On Mon, 12 Jan 2009, Peter Spierenburg wrote:\n>\n> \n>> I'm trying to push a local git repository to a remote site using WebDAV, \n>> but it is eating my lunch.\n>> \n>\n> Please see Documentation/howto/setup-git-server-over-http.txt.\n>\n> In short, http-push does not ask for a password interactively, but you \n> have to use .netrc.\n>\n> Hth,\n> Dscho\n>\n> \n"},{"id":"100218","messageId":"200901121953.16183.bss@iguanasuicide.net","threadId":"17126","inReplyTo":"496BE1E0.9010908@gmail.com","subject":"Re: git/webdav is refusing to authenticate properly.","fromName":"Boyd Stephen Smith Jr.","fromEmail":"bss@iguanasuicide.net","sentAt":"2009-01-13T01:53:15Z","receivedAt":"2009-01-13T01:53:15Z","isPatch":false,"sender":{"key":"bss@iguanasuicide.net","avatar":"https://gravatar.com/avatar/84b95eeff194b816c1568b1339e63e4b229825298664a9037b9f1ec713ead1e3?d=mp&s=160"},"body":"On Monday 12 January 2009, Peter Spierenburg \n wrote about 'Re: git/webdav is \nrefusing to authenticate properly.':\n>C'mon, leave my password 'in-the-clear', in a text file on a networked\n>box? That is the kind of prank a fourth-year student would try to pull\n>on a freshman.\n>\n>How do I really do it?\n\nAFAIK, that's the only way for now.\n\nPersonally, I'd welcome a patch that allowed fetch/push to prompt the user \nfor a password, but I'm not holding my breath. If I want to limit access \nto a few users, I serve that repository over ssh and depend on ssh for \nauthentication and filesystem permissions for authorization.\n-- \nBoyd Stephen Smith Jr. ,= ,-_-. =. \nbss@iguanasuicide.net ((_/)o o(\\_))\nICQ: 514984 YM/AIM: DaTwinkDaddy `-'(. .)`-' \nhttp://iguanasuicide.net/ \\_/ \n"},{"id":"100264","messageId":"alpine.DEB.1.00.0901131204420.3586@pacific.mpi-cbg.de","threadId":"17126","inReplyTo":"200901121953.16183.bss@iguanasuicide.net","subject":"Re: git/webdav is refusing to authenticate properly.","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2009-01-13T11:11:15Z","receivedAt":"2009-01-13T11:11:15Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Mon, 12 Jan 2009, Boyd Stephen Smith Jr. wrote:\n\n> On Monday 12 January 2009, Peter Spierenburg \n> wrote\n>\n> >C'mon, leave my password 'in-the-clear', in a text file on a networked \n> >box? That is the kind of prank a fourth-year student would try to pull \n> >on a freshman.\n> >\n> >How do I really do it?\n> \n> AFAIK, that's the only way for now.\n\nIndeed it is.\n\n> Personally, I'd welcome a patch that allowed fetch/push to prompt the \n> user for a password, but I'm not holding my breath.\n\nI guess everybody who wants that feature does exactly the same as you.\n\nOh, and FWIW: trying to ridicule the way Git does it completely misses the \nfact that you are using such a ridiculously weak authentication scheme \nanyway that you could just as well open the window and shout your password \nout loud.\n\nCiao,\nDscho\n\nP.S.: real security would require you to have public/private key based \nclient authentication. But that would leave you vulnerable, too, as you \nare apparently not on a trustable machine.\n\nP.P.S.: I have access to such a machine, too, but I never push _from_ \nthere. That is relatively safe, as only those can access my private keys \n(and my $HOME/.netrc, BTW, as you seemed to have missed .netrc's 0600 \nmode) can impersonate me without hassle using sudo anyway.\n"},{"id":"100296","messageId":"200901131220.35782.bss@iguanasuicide.net","threadId":"17126","inReplyTo":"alpine.DEB.1.00.0901131204420.3586@pacific.mpi-cbg.de","subject":"Re: git/webdav is refusing to authenticate properly.","fromName":"Boyd Stephen Smith Jr.","fromEmail":"bss@iguanasuicide.net","sentAt":"2009-01-13T18:20:30Z","receivedAt":"2009-01-13T18:20:30Z","isPatch":false,"sender":{"key":"bss@iguanasuicide.net","avatar":"https://gravatar.com/avatar/84b95eeff194b816c1568b1339e63e4b229825298664a9037b9f1ec713ead1e3?d=mp&s=160"},"body":"On Tuesday 13 January 2009, Johannes Schindelin \n wrote about 'Re: git/webdav is refusing to \nauthenticate properly.':\n>Oh, and FWIW: trying to ridicule the way Git does it completely misses\n> the fact that you are using such a ridiculously weak authentication\n> scheme anyway that you could just as well open the window and shout your\n> password out loud.\n\nUsing DIGEST auth would help, although it is still quite vulnerable, but I \ncouldn't convince git to use that either.\n\nI'm pretty sure even PLAIN auth is acceptable (security-wise) if used over \nSSL/TLS. It would be really nice for contributors behind oppressive firewalls \nif they could push via https and not have their passwords exposed to the \nlocal BOFH. (Who else sets up an oppressive firewall?)\n\nSVN supported it. It would be nice to add it to the list of git features. \nStill, it's just not important enough to me right now to make the time to \nthrow together a PATCH/RFC.\n-- \nBoyd Stephen Smith Jr. ,= ,-_-. =. \nbss@iguanasuicide.net ((_/)o o(\\_))\nICQ: 514984 YM/AIM: DaTwinkDaddy `-'(. .)`-' \nhttp://iguanasuicide.net/ \\_/ \n"}]}