{"thread":{"id":"17872","subject":"Gforge's cvssh.pl script and git","startedAt":"2009-02-18T09:24:18Z","lastAt":"2009-02-18T14:49:28Z","messageCount":4,"participants":["Bosko Ivanisevic","Johannes Schindelin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"105283","messageId":"2c0671440902180124v50570270gc40b745d4a8b1245@mail.gmail.com","threadId":"17872","inReplyTo":null,"subject":"Gforge's cvssh.pl script and git","fromName":"Bosko Ivanisevic","fromEmail":"bosko.ivanisevic@gmail.com","sentAt":"2009-02-18T09:24:18Z","receivedAt":"2009-02-18T09:24:18Z","isPatch":false,"sender":{"key":"bosko.ivanisevic@gmail.com","avatar":null},"body":"In the company I'm working someone has restricted access to all users\nto only use cvs via cvssh.pl script (source at the end of message)\ntaken from gforge. This script is set as a shell for all users. Now I\nwould like to change it so I can run git too. I've tried by adding\n'git', 'git-upload-pack', 'git-receive-pack' and 'git-shell' in the\narray @allowed_commands. After that if I try to clone existing\nrepository with:\n\ngit clone ssh://testuser@server_name/tmp/test.git\n\nI get following error:\n\nfatal: ''/tmp/test.git'': unable to chdir or not a git archive\nfatal: The remote end hung up unexpectedly\n\nI first thought that testuser doesn't have permissions to read\ndirectory /tmp/test.git so I changed mode and gave r+w permissions\nrecursively on that folder, but result was same.\n\nThere is no way I can avoid this perl script (company policy) but I\ncan change it. Problem is that I do not know Perl so much and I do not\nknow what git is exactly doing behind the scene when it is run via\nssh. Can anyone tell me why this perl script doesn't allow git to run\nproperly and what has to be changed to enable git?\n\n#! /usr/bin/perl -w\n#\n# $Id: cvssh.pl 3987 2005-02-26 22:59:11Z tperdue $\n#\n# \"Shell\" for a restricted account, limiting the available commands\n# Roland Mas, debian-sf (Sourceforge for Debian)\n#\n# Inspired from the grap.c file in Sourceforge 2.5\n\nuse strict ;\nuse vars qw/ @allowed_options @allowed_commands $errmsg @cmd / ;\nuse subs qw/ &reject / ;\nno locale ;\n\n@allowed_options = ('-c', '-e') ;\n@allowed_commands = ('cvs') ;\n\n# Clean up our environment\ndelete @ENV{qw(IFS CDPATH ENV BASH_ENV PATH)};\n\n@cmd = split (/ +/, $ENV{SSH_CLIENT});\n\nif (scalar (grep {/192.168.0/}  @cmd) == 0) {\n    $errmsg = \"Client address not allowed.\" ;\n    &reject ;\n}\n\nif ($#ARGV != 1) {\n    if ($#ARGV < 1) {\n        $errmsg = \"Not enough arguments.\" ;\n    } else {\n        $errmsg = \"Too many arguments.\" ;\n    }\n    &reject ;\n}\n\n\nif (scalar (grep  { $_ eq $ARGV[0] }  @allowed_options) == 0) {\n    $errmsg = \"Option not allowed.\" ;\n    &reject ;\n}\n\n@cmd = split (/ +/, $ARGV[1]) ;\n\n\nif (scalar (grep { $_ eq $cmd[0] }  @allowed_commands) == 0) {\n    $errmsg = \"Command not allowed.\" ;\n    &reject ;\n}\n\nexec @cmd ;\n\nsub reject {\n    print \"This is a restricted account.\\n\" .\n        \"You cannot execute anything here.\\n\" .\n        # $errmsg . \"\\n\" .\n        \"Goodbye.\\n\" ;\n    exit 1 ;\n}\n"},{"id":"105299","messageId":"alpine.DEB.1.00.0902181417510.6274@intel-tinevez-2-302","threadId":"17872","inReplyTo":"2c0671440902180124v50570270gc40b745d4a8b1245@mail.gmail.com","subject":"Re: Gforge's cvssh.pl script and git","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2009-02-18T13:24:17Z","receivedAt":"2009-02-18T13:24:17Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Wed, 18 Feb 2009, Bosko Ivanisevic wrote:\n\n> In the company I'm working someone has restricted access to all users\n> to only use cvs via cvssh.pl script (source at the end of message)\n> taken from gforge. This script is set as a shell for all users. Now I\n> would like to change it so I can run git too. I've tried by adding\n> 'git', 'git-upload-pack', 'git-receive-pack' and 'git-shell' in the\n> array @allowed_commands. After that if I try to clone existing\n> repository with:\n> \n> git clone ssh://testuser@server_name/tmp/test.git\n> \n> I get following error:\n> \n> fatal: ''/tmp/test.git'': unable to chdir or not a git archive\n> fatal: The remote end hung up unexpectedly\n> \n> I first thought that testuser doesn't have permissions to read\n> directory /tmp/test.git so I changed mode and gave r+w permissions\n> recursively on that folder, but result was same.\n\nr+w?  Not a+rwx?\n\nAnd only on /tmp/test.git/, or also on /tmp/?\n\nA better way would be to use 'sudo -u testuser git ls-remote \n/tmp/test.git' if sudo is available (you haven't revealed useful \ninformation about the host).\n\n> There is no way I can avoid this perl script (company policy) but I\n> can change it. Problem is that I do not know Perl so much and I do not\n> know what git is exactly doing behind the scene when it is run via\n> ssh.\n\nI'd use 'system(\"some shell >&2\");' to try to debug it.\n\nHth,\nDscho\n"},{"id":"105312","messageId":"2c0671440902180631lbf08d5egb003082a3c683f62@mail.gmail.com","threadId":"17872","inReplyTo":"alpine.DEB.1.00.0902181417510.6274@intel-tinevez-2-302","subject":"Re: Gforge's cvssh.pl script and git","fromName":"Bosko Ivanisevic","fromEmail":"bosko.ivanisevic@gmail.com","sentAt":"2009-02-18T14:31:41Z","receivedAt":"2009-02-18T14:31:41Z","isPatch":false,"sender":{"key":"bosko.ivanisevic@gmail.com","avatar":null},"body":"Hi,\n\nOn Wed, Feb 18, 2009 at 2:24 PM, Johannes Schindelin\n<Johannes.Schindelin@gmx.de> wrote:\n> Hi,\n>\n> On Wed, 18 Feb 2009, Bosko Ivanisevic wrote:\n>\n>> In the company I'm working someone has restricted access to all users\n>> to only use cvs via cvssh.pl script (source at the end of message)\n>> taken from gforge. This script is set as a shell for all users. Now I\n>> would like to change it so I can run git too. I've tried by adding\n>> 'git', 'git-upload-pack', 'git-receive-pack' and 'git-shell' in the\n>> array @allowed_commands. After that if I try to clone existing\n>> repository with:\n>>\n>> git clone ssh://testuser@server_name/tmp/test.git\n>>\n>> I get following error:\n>>\n>> fatal: ''/tmp/test.git'': unable to chdir or not a git archive\n>> fatal: The remote end hung up unexpectedly\n>>\n>> I first thought that testuser doesn't have permissions to read\n>> directory /tmp/test.git so I changed mode and gave r+w permissions\n>> recursively on that folder, but result was same.\n>\n> r+w?  Not a+rwx?\n>\n> And only on /tmp/test.git/, or also on /tmp/?\n>\n> A better way would be to use 'sudo -u testuser git ls-remote\n> /tmp/test.git' if sudo is available (you haven't revealed useful\n> information about the host).\n>\n\nThanks for your reply. Here are more data. System is SuSe 10.3. On the\ntest server which has same setup but I can change shell when I change\ntestuser's shell to /bin/bash I can regularly clone git repository\nfrom remote machine, so all permissions are set correctly. Besides,\noutput of:\n\ngit ls-remote ssh://testuser@server_name:/tmp/test.git\n\nis:\n\n3446c5347e0563cb87e1d8951c57b7f36996f44b        HEAD\n3446c5347e0563cb87e1d8951c57b7f36996f44b        refs/heads/master\n\nThat leads me to conclusion that perl's exec command makes some mess\nwhich prevents git of running correctly.\n\n>> There is no way I can avoid this perl script (company policy) but I\n>> can change it. Problem is that I do not know Perl so much and I do not\n>> know what git is exactly doing behind the scene when it is run via\n>> ssh.\n>\n> I'd use 'system(\"some shell >&2\");' to try to debug it.\n>\nI didn't understand this part. If I change\n\nexec @cmd;\n\ncommand from perl script to:\n\nsystem(\"/bin/bash >&2);\n\ngit clone just hangs on the client side. I guess I did something wrong\nbut don't know what.\n\nRegards,\nBosko\n"},{"id":"105313","messageId":"alpine.DEB.1.00.0902181547240.6274@intel-tinevez-2-302","threadId":"17872","inReplyTo":"2c0671440902180631lbf08d5egb003082a3c683f62@mail.gmail.com","subject":"Re: Gforge's cvssh.pl script and git","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2009-02-18T14:49:28Z","receivedAt":"2009-02-18T14:49:28Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Wed, 18 Feb 2009, Bosko Ivanisevic wrote:\n\n> On Wed, Feb 18, 2009 at 2:24 PM, Johannes Schindelin\n> <Johannes.Schindelin@gmx.de> wrote:\n>\n> > On Wed, 18 Feb 2009, Bosko Ivanisevic wrote:\n> >\n> >> In the company I'm working someone has restricted access to all users \n> >> to only use cvs via cvssh.pl script (source at the end of message) \n> >> taken from gforge. This script is set as a shell for all users. Now I \n> >> would like to change it so I can run git too. I've tried by adding \n> >> 'git', 'git-upload-pack', 'git-receive-pack' and 'git-shell' in the \n> >> array @allowed_commands. After that if I try to clone existing \n> >> repository with:\n> >>\n> >> git clone ssh://testuser@server_name/tmp/test.git\n> >>\n> >> I get following error:\n> >>\n> >> fatal: ''/tmp/test.git'': unable to chdir or not a git archive\n> >> fatal: The remote end hung up unexpectedly\n> >>\n> >> I first thought that testuser doesn't have permissions to read\n> >> directory /tmp/test.git so I changed mode and gave r+w permissions\n> >> recursively on that folder, but result was same.\n> >\n> > r+w?  Not a+rwx?\n> >\n> > And only on /tmp/test.git/, or also on /tmp/?\n> >\n> > A better way would be to use 'sudo -u testuser git ls-remote\n> > /tmp/test.git' if sudo is available (you haven't revealed useful\n> > information about the host).\n> \n> Thanks for your reply. Here are more data. System is SuSe 10.3. On the \n> test server which has same setup but I can change shell when I change \n> testuser's shell to /bin/bash I can regularly clone git repository from \n> remote machine, so all permissions are set correctly. Besides, output \n> of:\n> \n> git ls-remote ssh://testuser@server_name:/tmp/test.git\n> \n> is:\n> \n> 3446c5347e0563cb87e1d8951c57b7f36996f44b        HEAD\n> 3446c5347e0563cb87e1d8951c57b7f36996f44b        refs/heads/master\n> \n> That leads me to conclusion that perl's exec command makes some mess\n> which prevents git of running correctly.\n\nMaybe.  Maybe it is also unsetting ENV which causes grief.\n\n> >> There is no way I can avoid this perl script (company policy) but I \n> >> can change it. Problem is that I do not know Perl so much and I do \n> >> not know what git is exactly doing behind the scene when it is run \n> >> via ssh.\n> >\n> > I'd use 'system(\"some shell >&2\");' to try to debug it.\n> >\n> I didn't understand this part. If I change\n> \n> exec @cmd;\n> \n> command from perl script to:\n> \n> system(\"/bin/bash >&2);\n> \n> git clone just hangs on the client side. I guess I did something wrong\n> but don't know what.\n\nI did not mean to replace the exec.  Rather, I meant you could do \nsomething like\n\n\tsystem('ls -l /tmp/test.git >&2');\n\nto see what is actually happening.  I mean, it could be that for some \nreason I do not understand, the whole thing runs in a chroot or some such.\n\nCiao,\nDscho\n"}]}