1

I create a ssh server on my suse box,basically I just want it to serve as a git server using ssh, but when I login with ssh name@server I can look at my home/repo directory, that's normal, but I can even check the file from other user such as home/steve which I don't want it to, How to setup the user repo to only have access to git directory? say home/repo/repository.git ? or just files from /home/repo ?

I've disabled the "permit Root Login" from Yast2-sshd configuration tool (basically just a tool to edit /etc/sshd/sshd_config )",but it seems that's not enough.

user1051003
  • 1,211
  • 5
  • 16
  • 24
  • I would suggest you to use gitolite (https://github.com/sitaramc/gitolite). Then your users don't need to have a login in the server. – giZm0 Aug 15 '12 at 10:12

2 Answers2

1

If you set the user's shell to be git-shell, they can do nothing but run git commands.

If you don't need fine-grained permissions, then you don't need gitolite or similar

Community
  • 1
  • 1
AD7six
  • 63,116
  • 12
  • 91
  • 123
0

ssh is too powerful in that it allows for an interactive session.
A giZm0 mentions, gitolite is an authorization layer that can leverage the authentication provided by ssh and allows for a fine-grained level of access control over your repositories.
It is just a perl script, which can set itself in the ~/.ssh/authorized_keys file in order to intercept any git command, and validate them against a simple text config file.
This takes advantage of an ssh feature (nothing to do with git), called forced command.

Note: gitolite can also be linked with an httpd server: see "Why do you need Gitosis or Gitolite?" or "git on HTTP with gitolite and nginx" for more.

Community
  • 1
  • 1
VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
  • gitolite is easy to setup and flexible for permission issues. – Drake Guan Aug 15 '12 at 10:31
  • @Drake agreed, and since gitolite V3 or 'g3' and its VREF, you can control *a lot* of things: see http://stackoverflow.com/questions/11569263/git-hook-to-detect-file-changes-that-contain-a-certain-string/11573529#11573529 for instance. – VonC Aug 15 '12 at 10:39