# plain text git credentials

**URL:** <https://forum.ansible.com/t/plain-text-git-credentials/29275>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [December 17, 2018, 12:06pm UTC](https://forum.ansible.com/t/plain-text-git-credentials/29275 "2018-12-17T12:06:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ruben\_de\_Groot](https://avatars.discourse-cdn.com/v4/letter/r/7bcc69/32.png) [@Ruben\_de\_Groot](https://forum.ansible.com/u/Ruben_de_Groot)\
**Post date:** [December 17, 2018, 12:06pm UTC](https://forum.ansible.com/t/plain-text-git-credentials/29275/1 "2018-12-17T12:06:31Z")

</div>

Hi

While setting up an awx container for our devops department I noticed git credentials are stored in plain text on the filesystem (in /var/lib/awx/\_some\_project/.git/config e.g.). Not sure if this is a known issue, but in our environment it is a security issue (server admin having access to these credentials). Maybe I’m misconfiguring something?  
Any tips/opinions are greatly appreciated.

Ruben de Groot

---

<div class="post-metadata">

**Author:** ![matburt](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matburt/32/3612_2.png) [@matburt](https://forum.ansible.com/u/matburt)\
**Post date:** [December 17, 2018, 3:28pm UTC](https://forum.ansible.com/t/plain-text-git-credentials/29275/2 "2018-12-17T15:28:55Z")

</div>

You should probably use ssh-based credentials instead.

---

<div class="post-metadata">

**Author:** ![Ruben\_de\_Groot](https://avatars.discourse-cdn.com/v4/letter/r/7bcc69/32.png) [@Ruben\_de\_Groot](https://forum.ansible.com/u/Ruben_de_Groot)\
**Post date:** [December 17, 2018, 6:10pm UTC](https://forum.ansible.com/t/plain-text-git-credentials/29275/3 "2018-12-17T18:10:22Z")

</div>

Yes. I got the same suggestion on IRC, and it looks like this works.  
However, it is unnecessary to put the plain text credentials for http basic auth in the .git/config file on disk in the form “url = https://\<username\>:\<password\>@gitlab.com/path/to/repo.got”.  
This could be done with a POST request, hiding the plain text password from the on-disk url.

---

<div class="post-metadata">

**Author:** ![matburt](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matburt/32/3612_2.png) [@matburt](https://forum.ansible.com/u/matburt)\
**Post date:** [December 17, 2018, 8:25pm UTC](https://forum.ansible.com/t/plain-text-git-credentials/29275/4 "2018-12-17T20:25:33Z")

</div>

iirc this comes from what is required by the git module in Ansible directly.