CODEWITHSUNDEEP
gitpermissionsssh
user1051003
user1051003

Reputation: 1231

ssh is too "powerful" for a remote git repository? how to setup permission?

I create a ssh server on my suse box,basically I just want it to serve as a git server using ssh, but when I login with ssh name@server I can look at my home/repo directory, that's normal, but I can even check the file from other user such as home/steve which I don't want it to, How to setup the user repo to only have access to git directory? say home/repo/repository.git ? or just files from /home/repo ?

I've disabled the "permit Root Login" from Yast2-sshd configuration tool (basically just a tool to edit /etc/sshd/sshd_config )",but it seems that's not enough.

Upvotes: 1

Views: 273

Answers (2)

AD7six
AD7six

Reputation: 66237

If you set the user's shell to be git-shell, they can do nothing but run git commands.

If you don't need fine-grained permissions, then you don't need gitolite or similar

Upvotes: 1

VonC
VonC

Reputation: 1324723

ssh is too powerful in that it allows for an interactive session.
A giZm0 mentions, gitolite is an authorization layer that can leverage the authentication provided by ssh and allows for a fine-grained level of access control over your repositories.
It is just a perl script, which can set itself in the ~/.ssh/authorized_keys file in order to intercept any git command, and validate them against a simple text config file.
This takes advantage of an ssh feature (nothing to do with git), called forced command.

Note: gitolite can also be linked with an httpd server: see "Why do you need Gitosis or Gitolite?" or "git on HTTP with gitolite and nginx" for more.

Upvotes: 0

Related Questions