Git, Apache and HTTPS with a free certificate

From Wiki de Caballero
Jump to navigation Jump to search

Prerequisites

  • Ubuntu CLI understanding
  • Git knowledge
  • Ubuntu, this was tested using Ubuntu 16
  • Apache 2

Git using Apache

This is a basic setup to allow Git on a server to be accessible via HTTP (no HTTPS yet, read further).

  1.  Install Apache
    sudo apt-get install apache2 apache2-utils
  2. Enable necessary modules
    a2enmod cgi alias env
  3. (Optional) Add user(s) to the htpasswd file. This step is optional if this setup is going to serve only anonymous repository (pull/fetch). However if you want to push or if you want to allow to only obtain a repository using user/pass combo this step is necessary (see next step).
    # Create file and add a user
    # -c = create file
    # The file is stored in /git/ the git repository for this specific setup
    htpasswd -c /git/.htpasswd [user name]
    # This will ask for a password
    
    # Add a user to the file
    htpasswd /git/.htpasswd [user name]
  4. To allow to obtain a git repository using http, add the following to the apache2.conf
    # Path to the Git directory (inside the OS)
    SetEnv GIT_PROJECT_ROOT /git
    
    # Allows all projects to be served
    # If commented a file must exist in each available repository via Apache, file name: git-daemon-export-ok
    SetEnv GIT_HTTP_EXPORT_ALL
    
    # Defines the URL path where git is located, as seen via http
    # First param is path, second is os path to git-http-backend, don't forget the last slash
    ScriptAlias /git/ /usr/lib/git-core/git-http-backend/
    
    # Access configuration
    <Files "git-http-backend">
    	# Enable Basic HTTP Authentication
    	AuthType Basic
    	AuthName "Git Access"
    	AuthUserFile /git/.htpasswd
    	# The following line allows to obtain a repository (pull/fetch) without having a user/pass combo
    	# Comment it if user/pass are needed to obtain info as well
    	Require expr !(%{QUERY_STRING} -strmatch '*service=git-receive-pack*' || %{REQUEST_URI} =~ m#/git-receive-pack$#)
    	Require valid-user
    	# END Enable Basic HTTP Authentication
    </Files>

Additional info:

Self signed Certificate

How Certificates work

Here are some videos on how certificates and SSL (TLS) work:

Additional info:

Why certificates are needed

To allow git to be served using https the server must have a certificate. Now, this certificate can be signed by a root Certificate Authority (CA), an Intermediate Cerfificate Authority (validated by a root CA) or a self signed certificate. To get a root or intermediate CA Certificate you must contact a company to give you one and pay for it. You could also create your own root or intermediate CA but this outside the scope of this article.

How to create a self-signed Certificate

This is done on an Ubuntu 16 but you could do this in another system, you do need OpenSSl.

The process is actually very simple.

# One line
# -nodes = not encrypted, if you leave this out, Apache will ask for a password when using the certificate
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout selfsigned.key -out selfsigned.crt

# Two steps
openssl genrsa -des3 -out rootCA.key 2048
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem

# Three steps
openssl genrsa -des3 -out server.key 2048
openssl req -new -key server.key -out server.csr
openssl x509 -req -sha256 -days 365 -in server.csr -signkey server.key -out server.crt



How to create a Root Certificate authority and child certificates

Other sites:

Adding the certificate to Apache

Ensuring the right protocol:

Other links:

Configuring Git to use the self signed certificate

More sites:

Client based authentication using certificates in Apache

Used links:

Other links:

(Possibly) Giving Git a Client Certificate

More (possibly useful) info