1

I create a ssh server on my suse box,basically I just want it to serve as a git server using ssh, but when I login with ssh name@server I can look at my home/repo directory, that's normal, but I can even check the file from other user such as home/steve which I don't want it to, How to setup the user repo to only have access to git directory? say home/repo/repository.git ? or just files from /home/repo ?

I've disabled the "permit Root Login" from Yast2-sshd configuration tool (basically just a tool to edit /etc/sshd/sshd_config )",but it seems that's not enough.

user1051003
  • 1,111
  • 4
  • 14
  • 24
  • I would suggest you to use gitolite (https://github.com/sitaramc/gitolite). Then your users don't need to have a login in the server. – giZm0 Aug 15 '12 at 10:12

2 Answers2

1

If you set the user's shell to be git-shell, they can do nothing but run git commands.

If you don't need fine-grained permissions, then you don't need gitolite or similar

Community
  • 1
  • 1
AD7six
  • 59,391
  • 12
  • 88
  • 120
0

ssh is too powerful in that it allows for an interactive session.
A giZm0 mentions, gitolite is an authorization layer that can leverage the authentication provided by ssh and allows for a fine-grained level of access control over your repositories.
It is just a perl script, which can set itself in the ~/.ssh/authorized_keys file in order to intercept any git command, and validate them against a simple text config file.
This takes advantage of an ssh feature (nothing to do with git), called forced command.

Note: gitolite can also be linked with an httpd server: see "Why do you need Gitosis or Gitolite?" or "git on HTTP with gitolite and nginx" for more.

Community
  • 1
  • 1
VonC
  • 1,129,465
  • 480
  • 4,036
  • 4,755
  • gitolite is easy to setup and flexible for permission issues. – Drake Guan Aug 15 '12 at 10:31
  • @Drake agreed, and since gitolite V3 or 'g3' and its VREF, you can control *a lot* of things: see http://stackoverflow.com/questions/11569263/git-hook-to-detect-file-changes-that-contain-a-certain-string/11573529#11573529 for instance. – VonC Aug 15 '12 at 10:39