Site icon TheWindowsUpdate.com

Azure Tips and Tricks – Remove Azure Secrets committed to GitHub

This post has been republished via RSS; it originally appeared at: Azure Developer Community Blog articles.

Remove Azure Secrets committed to GitHub

 

Remove passwords committed to GitHub on accident

 

Writing code day after day means secrets, connection strings and more get added to your code accidentally. And if you are like me, they get committed to your GitHub repo and then you have to live in shame. =) In this post, I'll walk you through removing secrets from a GitHub repo that you've already committed the secret to.

 

Part 1 - Initial setup:

 

Scenario: You have committed a password with the value of qph@}uC,7cGLBdsX to your GitHub repo. This password should be confidential and not stored in the code.

 

How do you fix it?

 

Below is an example of my repo.

 

 

[mbcrump@Michaels-MBP-3]:[~/Documents/code]$ cd crumpbot.git [mbcrump@Michaels-MBP-3]:[~/Documents/code/crumpbot.git] (BARE:master)$ ls -l total 32 -rw-r--r-- 1 mbcrump staff 23 Dec 1 19:47 HEAD -rw-r--r-- 1 mbcrump staff 211 Dec 1 19:47 config -rw-r--r-- 1 mbcrump staff 73 Dec 1 19:47 description drwxr-xr-x 13 mbcrump staff 416 Dec 1 19:47 hooks drwxr-xr-x 3 mbcrump staff 96 Dec 1 19:47 info drwxr-xr-x 27 mbcrump staff 864 Dec 1 19:48 objects -rw-r--r-- 1 mbcrump staff 105 Dec 1 19:47 packed-refs drwxr-xr-x 4 mbcrump staff 128 Dec 1 19:47 refs

 

Part 2 - Create a file of passwords that you'd like to remove:

I created mine on macOS with touch passwords.txt or echo some-text > passwords.txt on Windows and added the password that I accidentally committed:

 

 

qph@}uC,7cGLBdsX

 

Part 3 - Install BFG:

Enter BFG (opens new window). According to the author:

BFG is a simpler, faster alternative to git-filter-branch for cleansing bad data out of your Git repository history: Removing Crazy Big Files Removing Passwords, Credentials & other Private data

Part 4 - Clean up the passwords previously committed:

 

[mbcrump@Michaels-MBP-3]:[~/Documents/code]$ bfg --replace-text passwords.txt crumpbot.git Using repo : /Users/mbcrump/Documents/code/crumpbot.git Found 2489 objects to protect Found 2 commit-pointing refs : HEAD, refs/heads/master Protected commits ----------------- These are your protected commits, and so their contents will NOT be altered: * commit 58969937 (protected by 'HEAD') Cleaning -------- Found 11 commits Cleaning commits: 100% (11/11) Cleaning commits completed in 96 ms. Updating 1 Ref -------------- Ref Before After --------------------------------------- refs/heads/master | 58969937 | 3f9041c9 Updating references: 100% (1/1) ...Ref update completed in 24 ms. Commit Tree-Dirt History ------------------------ Earliest Latest | | D D D D DD D D m m m D = dirty commits (file tree fixed) m = modified commits (commit message or parents changed) . = clean commits (no changes to file tree) Before After ------------------------------------------- First modified commit | 39e68d03 | 95e6f9f4 Last dirty commit | 2007b5c5 | 0f57a693 Changed files ------------- Filename Before & After -------------------------------------------------------- bot.js | 1b55a8d0 ⇒ 02758dd8, cba19782 ⇒ db95f8c2, ... In total, 19 object ids were changed. Full details are logged here: /Users/mbcrump/Documents/code/crumpbot.git.bfg-report/2019-12-01/19-48-22 BFG run is complete! When ready, run: git reflog expire --expire=now --all && git gc --prune=now --aggressive

 

Part 5 - Pushing to GitHub:

Part 6 - Wrap-up and verify your repo was updated successfully:

If you go back to your GitHub repo and look at prior commits, then you should see REMOVED like the following:

 

 

var tmi = require("tmi.js") var channel = "mbcrump" var config = { options: { debug: true }, connection: { cluster: "aws", reconnect: true }, identity: { username: "mbcrump", password: "***REMOVED***" }, channels: [channel] }

 

I hope this helps someone out there and if you want to stay in touch then I can be found on TwitchTwitter or GitHub.

 

Create a trial account today and go and check it out!

Exit mobile version