@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Clarify why VCS passwords must be unique
Summary: Fixes T10265.
Test Plan: Read text.
Reviewers: chad
Reviewed By: chad
Maniphest Tasks: T10265
Differential Revision: https://secure.phabricator.com/D15173
+7
-2
+7
-2
src/docs/user/userguide/diffusion_hosting.diviner
+7
-2
src/docs/user/userguide/diffusion_hosting.diviner
···
127
127
use only anonymous HTTP, you can leave this setting disabled.
128
128
129
129
If you plan to use authenticated HTTP, you'll also need to configure a VCS
130
-
password in {nav Settings > VCS Password}. This is a different password than
131
-
your main Phabricator password primarily for security reasons.
130
+
password in {nav Settings > VCS Password}.
131
+
132
+
Your VCS password must be a different password than your main Phabricator
133
+
password because VCS passwords are very easy to accidentally disclose. They are
134
+
often stored in plaintext in world-readable files, observable in `ps` output,
135
+
and present in command output and logs. We strongly encourage you to use SSH
136
+
instead of HTTP to authenticate access to repositories.
132
137
133
138
Otherwise, if you've configured system accounts above, you're all set. No
134
139
additional server configuration is required to make HTTP work.