Skip to main content
Tutorial

How do I avoid having a plaintext password in .git/config with Cribl Stream?

  • September 12, 2026
  • 0 replies
  • 3 views
Jessica Bracken

Objective

Configure a Cribl Stream remote Git repository without storing a plaintext password in .git/config.

Environment

  • Cribl Stream Leader
  • On-premises deployment with an external Git repository
  • Basic authentication or a credential-bearing Remote URL

Procedure

  1. Rotate the Git password or token if it may already have been exposed.
  2. On the Cribl Stream Leader, create an SSH key pair from the CLI as the Cribl service user. Use a passphrase-protected private key when required by your security policy.
  3. Add the public key to the Git provider with permission to access the repository.
  4. Configure the Cribl remote repository to use the provider’s SSH URL and SSH authentication. Do not include a username, password, or token in the Remote URL.
  5. Complete passphrase-protected SSH configuration through the Leader CLI, because this capability is CLI-only.
  6. Configure and verify SSH host-key handling for the Git provider, then test a Git operation such as commit and push.
  7. Confirm that the remote URL in .git/config contains only the SSH URL and no plaintext password or token.

Additional Information

See Connect to External Git Repositories for the supported SSH URL format, SSH authentication, host-key setup, and remote-repository security considerations.

Terms & ConditionsAccessibility statement