Git http - securely remember credentials

Question

Is there a way to securely let git remember my credentials when connecting to remote repositories over HTTP(S)?

I've tried the core.askpass approach detailed in git-config to let an external script supply my credentials. Although it works great the username and password is still stored in plain text in the small shell script.

Answer 1

git invokes cURL when running over HTTP. You can store secure credentials by setting up a .netrc file in your user's home directory, and making it private to the user (0600 in Linux).

The contents of the file provide the username and password per remote domain.

machine myRemoteServer login myUserName password s3cret 

See https://stackoverflow.com/questions/3947530/git-push-fatal-failed/7177690#7177690 for full server side configuration, which can easily include calls to your ldap server.

Answer 2

Since (I think) git version 1.7.8, from 2 December 2011¹⁾, git supports so called credentials helpers.

See gitcredentials(7) manpage for details
^{(This manpage also decribes where core.askpass fits into this).}

The default git installation includes two helpers:

• cache: See git-credential-cache(1) for details.

  Cache credentials in memory for a short period of time. The stored credentials never touch the disk, and are forgotten after a configurable timeout. Note that it is Unix-only solution, as it uses socket to communicate with daemon.

• store: See git-credential-store(1) for details.

  Store credentials indefinitely on disk. The file will have its filesystem permissions set to prevent other users on the system from reading it, but will not be encrypted or otherwise protected. The same security as .netrc solution in Eddie response

---

There are some third-party credential helpers for storing username and password in KDEWallet (KDE), in GNOME Keyring, in Windows Credential Store (this is now integrated in Git for Windows), in MacOS X Keychain, etc.

---

Footnotes:

¹⁾ The Set Up Git GitHub Help page mentions that

You need git 1.7.10 or newer to use the credential helper