Git HTTPS password security

[Ahmil Jilani]

I'd like to link FishEye to my GitHub repo, but I'm concerned about security. If I link them using HTTPS as described here: https://confluence.atlassian.com/display/FISHEYE/Authentication, will the password be encrypted or stored in the clear?

I tried using the SSH method, but I got the following error after adding the key to GitHub and pressing Test Connection in FishEye:

Fisheye is using '/usr/bin/ssh' to authenticate with SSH authenticated repositories.

Error testing connection.

Error talking to repository:

at com.atlassian.fisheye.git.GitScmConfig.testConnection(GitScmConfig.java:147)

at com.cenqua.fisheye.RepositoryConfig.testConnection(RepositoryConfig.java:441)

at com.atlassian.fisheye.spi.admin.impl.DefaultRepositoryAdminService.testConnectionFor(DefaultRepositoryAdminService.java:573)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)

Connection failed.

I'm using self-hosted FishEye Version:3.3.1 Build:20140221105018 2014-02-21

[Tiago Comasseto · Accepted solution]

Hi Ahmil, the repository password in Fisheye is stored in the file called config.xml and it's stored in plain text. This improvement request was opened in the past to this matter, it's currently closed, but you may post your comments that and our developers may reconsider implementing this improvement.

Cheers