6

My question is

how can I allow an user to ssh to my server with limitation to a shell command and a directory?

My situation

I'm using git to deploy code to my Server. I have 2 servers, 1st one is product server, 2nd one is a git server.

My team use git server to pull/push code.

At my product server, I setup git client. Whenever I want to publish a version, I push it to my git server (master or other branches ...), then I ssh into my product server to pull the code.

I want to share the code pulling privilege with my teammates, but don't want to allow them to run any command but git, and limit them in a directory only.

The owner of directory that I want to limit is apache:apache, so it will be very good if the ssh user run by apache privilege.

Thank you,

Solved: I've used lshell with a limit set of commands.

Tarzan
  • 529
  • 3
  • 14
  • I think you might be looking for this. Click here: http://stackoverflow.com/questions/402615/how-to-restrict-ssh-users-to-a-predefined-set-of-commands-after-login – vkrams May 22 '13 at 04:05

2 Answers2

12

A simple command to disable the shell in a git user is to replace the /usr/bin/bash with /usr/bin/git-shell. Replace it in the /etc/password file or using the command:

usermod -s /usr/bin/git-shell [username]

Check this document from the official Git website: Setting Up the Server. Additional info if you want to have a shell on it but limiting it to a directory use: rbash. Same as git-shell just replace the user shell with it.

Ed Abucay
  • 483
  • 7
  • 20
  • I've tried to use git-shell but did not know how to put the other commands to ~/git-shell-commands, the default commands are just *help* and *list*. Thank you, – Tarzan May 23 '13 at 03:31
3

You should consider gitolite, which is an authorization layer which can ssh forced command.

And ssh forced command is there precisely to limit ssh to one unique command (in the case of gitolite, a script which will control access right, and make sure only git commands are executed).

forced command

Even if you don't use gitolite, ssh forced command alone (not linked to git at all) is still interesting to consider, in order to control and limit what a user can do through an ssh session.

The OP Tarzan, who didn't want to install another service, installed another service (Ishell), which is precisely based on ssh forced command ;)

Community
  • 1
  • 1
VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
  • My product Server has a production website running on it, so I do not want to setup more services (like gitolite), I've just setup git client. However on my git server, I did setup gitolite & gitlab on it. Thanks for your advice. – Tarzan May 23 '13 at 03:27
  • @Tarzan forced command is a feature of ssh and doesn't require to install any additional service. – VonC May 23 '13 at 03:42
  • @Tarzan I have included IShell in the answer: it uses forced command, exactly as I recommended in my answer. – VonC May 23 '13 at 05:20
  • Thank you, I meant that gitolite is a system, that heavier and bigger than lshell. Sorry about wrong explain. – Tarzan May 23 '13 at 08:19
  • 1
    @Tarzan I understand. But the suggestion of using forced command is still valid, is it not? – VonC May 23 '13 at 09:25