{"thread":{"id":"21045","subject":"How does gitosis know who the key belongs to","startedAt":"2009-09-24T14:51:44Z","lastAt":"2009-09-25T12:01:58Z","messageCount":9,"participants":["Howard Miller","Heiko Voigt","Matthieu Moy","Sitaram Chamarty"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"123737","messageId":"26ae428a0909240751k3a799750h121935a79439b389@mail.gmail.com","threadId":"21045","inReplyTo":null,"subject":"How does gitosis know who the key belongs to","fromName":"Howard Miller","fromEmail":"howard@e-learndesign.co.uk","sentAt":"2009-09-24T14:51:44Z","receivedAt":"2009-09-24T14:51:44Z","isPatch":false,"sender":{"key":"howard@e-learndesign.co.uk","avatar":"https://gravatar.com/avatar/ddb66c6a4a077e52b823ac5b04f33ab927cb90e2ab1eafedaeba07b1920bb99e?d=mp&s=160"},"body":"Hi,\n\nThis is probably another one of my stupid questions.\n\nGitosis obviously uses keypairs but the config file addresses the user\nby name/host. How does gitosis connect the two together? Is it any\nmore complicated than the user detail at the end of the public key?\n\nThe second part of my question then is is it possible to use the same\nprivate key on more than one host?\n\nCheers,\n\nHoward\n"},{"id":"123744","messageId":"20090924172610.GA31309@book.hvoigt.net","threadId":"21045","inReplyTo":"26ae428a0909240751k3a799750h121935a79439b389@mail.gmail.com","subject":"Re: How does gitosis know who the key belongs to","fromName":"Heiko Voigt","fromEmail":"hvoigt@hvoigt.net","sentAt":"2009-09-24T17:26:16Z","receivedAt":"2009-09-24T17:26:16Z","isPatch":false,"sender":{"key":"hvoigt@hvoigt.net","avatar":"https://avatars.githubusercontent.com/u/184958?v=4"},"body":"On Thu, Sep 24, 2009 at 03:51:44PM +0100, Howard Miller wrote:\n> Gitosis obviously uses keypairs but the config file addresses the user\n> by name/host. How does gitosis connect the two together? Is it any\n> more complicated than the user detail at the end of the public key?\n\nNot much different. It uses the command feature of the authorized_keys\nfile of ssh to limit access to the 'gitosis-serve' command which is\ngiven the username from the gitosis.conf as argument. gitosis-server\nthen takes care of the access control.\n\n> The second part of my question then is is it possible to use the same\n> private key on more than one host?\n\nYes definitely. It identifies the user not the host. Although you can\nuse differenty keys if you want.\n\ncheers Heiko\n"},{"id":"123748","messageId":"vpqskeckuto.fsf@bauges.imag.fr","threadId":"21045","inReplyTo":"20090924172610.GA31309@book.hvoigt.net","subject":"Re: How does gitosis know who the key belongs to","fromName":"Matthieu Moy","fromEmail":"matthieu.moy@grenoble-inp.fr","sentAt":"2009-09-24T19:26:43Z","receivedAt":"2009-09-24T19:26:43Z","isPatch":false,"sender":{"key":"matthieu.moy@grenoble-inp.fr","avatar":"https://gravatar.com/avatar/72c8a2705971a25dfaff23cece15130d405685845d911aedd5667ace277f3fc5?d=mp&s=160"},"body":"Heiko Voigt writes:\n\n> On Thu, Sep 24, 2009 at 03:51:44PM +0100, Howard Miller wrote:\n>> Gitosis obviously uses keypairs but the config file addresses the user\n>> by name/host. How does gitosis connect the two together? Is it any\n>> more complicated than the user detail at the end of the public key?\n\nThe user@host at the end of the public key is mostly a comment. No\nserious software would use it for authentication, since you can freely\nedit it without changing the rest of the key.\n\n> Not much different. It uses the command feature of the authorized_keys\n> file of ssh to limit access to the 'gitosis-serve' command which is\n> given the username from the gitosis.conf as argument.\n\n... the username -> key association being done in gitosis's\nconfiguration itself (the key held in keydir/foobar is the one of user\nfoobar).\n\n-- \nMatthieu Moy\nhttp://www-verimag.imag.fr/~moy/\n"},{"id":"123753","messageId":"26ae428a0909242310r259ccf5eya7c95b8f43fc5c23@mail.gmail.com","threadId":"21045","inReplyTo":"vpqskeckuto.fsf@bauges.imag.fr","subject":"Re: How does gitosis know who the key belongs to","fromName":"Howard Miller","fromEmail":"howard@e-learndesign.co.uk","sentAt":"2009-09-25T06:10:07Z","receivedAt":"2009-09-25T06:10:07Z","isPatch":false,"sender":{"key":"howard@e-learndesign.co.uk","avatar":"https://gravatar.com/avatar/ddb66c6a4a077e52b823ac5b04f33ab927cb90e2ab1eafedaeba07b1920bb99e?d=mp&s=160"},"body":"Hi,\n\nI don't really understand the answers I have been given. Trying\ndesperately not to \"top post\" see bellow...\n\n2009/9/24 Matthieu Moy :\n> Heiko Voigt writes:\n>\n>> On Thu, Sep 24, 2009 at 03:51:44PM +0100, Howard Miller wrote:\n>>> Gitosis obviously uses keypairs but the config file addresses the user\n>>> by name/host. How does gitosis connect the two together? Is it any\n>>> more complicated than the user detail at the end of the public key?\n>\n> The user@host at the end of the public key is mostly a comment. No\n> serious software would use it for authentication, since you can freely\n> edit it without changing the rest of the key.\n>\n>> Not much different. It uses the command feature of the authorized_keys\n>> file of ssh to limit access to the 'gitosis-serve' command which is\n>> given the username from the gitosis.conf as argument.\n>\n> ... the username -> key association being done in gitosis's\n> configuration itself (the key held in keydir/foobar is the one of user\n> foobar).\n\n\nYes, I realise that the association is done im gitosis' config file,\nbut that is exactly my question - how does that association work?\n\nTo take a step back - I have to put a name (or a name@hostname) in the\nconfiguration file. How do I know what that should be in the general\nsense? When I create a key it doesn't ask me for the username I want\nso I see a disconnect here. Do I put a name, do I put name@hostname,\ndoes it matter and (again) how does it know which is 'my' public key?\nIs it the naming convention of the key or something magic? Plus, when\nI actually use gitosis, I am logging as the user 'git' so how does it\nknow who I am? I am thoroughly confused by the whole thing. I'm\nprobably missing something really obvious but, AFAIK, this is not\ncovered at all in the docs.\n\nThanks!\n\nHoward\n"},{"id":"123754","messageId":"26ae428a0909242315x3cf1aafcue004a73f5c471450@mail.gmail.com","threadId":"21045","inReplyTo":"26ae428a0909242310r259ccf5eya7c95b8f43fc5c23@mail.gmail.com","subject":"Re: How does gitosis know who the key belongs to","fromName":"Howard Miller","fromEmail":"howard@e-learndesign.co.uk","sentAt":"2009-09-25T06:15:18Z","receivedAt":"2009-09-25T06:15:18Z","isPatch":false,"sender":{"key":"howard@e-learndesign.co.uk","avatar":"https://gravatar.com/avatar/ddb66c6a4a077e52b823ac5b04f33ab927cb90e2ab1eafedaeba07b1920bb99e?d=mp&s=160"},"body":"2009/9/25 Howard Miller :\n> Hi,\n>\n> I don't really understand the answers I have been given. Trying\n> desperately not to \"top post\" see bellow...\n>\n> 2009/9/24 Matthieu Moy :\n>> Heiko Voigt writes:\n>>\n>>> On Thu, Sep 24, 2009 at 03:51:44PM +0100, Howard Miller wrote:\n>>>> Gitosis obviously uses keypairs but the config file addresses the user\n>>>> by name/host. How does gitosis connect the two together? Is it any\n>>>> more complicated than the user detail at the end of the public key?\n>>\n>> The user@host at the end of the public key is mostly a comment. No\n>> serious software would use it for authentication, since you can freely\n>> edit it without changing the rest of the key.\n>>\n>>> Not much different. It uses the command feature of the authorized_keys\n>>> file of ssh to limit access to the 'gitosis-serve' command which is\n>>> given the username from the gitosis.conf as argument.\n>>\n>> ... the username -> key association being done in gitosis's\n>> configuration itself (the key held in keydir/foobar is the one of user\n>> foobar).\n>\n>\n> Yes, I realise that the association is done im gitosis' config file,\n> but that is exactly my question - how does that association work?\n>\n> To take a step back - I have to put a name (or a name@hostname) in the\n> configuration file. How do I know what that should be in the general\n> sense? When I create a key it doesn't ask me for the username I want\n> so I see a disconnect here. Do I put a name, do I put name@hostname,\n> does it matter and (again) how does it know which is 'my' public key?\n> Is it the naming convention of the key or something magic? Plus, when\n> I actually use gitosis, I am logging as the user 'git' so how does it\n> know who I am? I am thoroughly confused by the whole thing. I'm\n> probably missing something really obvious but, AFAIK, this is not\n> covered at all in the docs.\n>\n> Thanks!\n>\n> Howard\n>\n\n\nAhh... just read Heiko's post properly and actually looked at the\nauthorized_keys file. This is now starting to make some sense. So the\nname in config has to match that sent to gitosis-server presumably. I\nstill don't quite see the cause and effect. If I don't like being\nhoward@x.y.z and would rather be just 'howard' what can I change? It\ntells me not to edit that file!\n"},{"id":"123756","messageId":"20090925063314.GB27809@book.hvoigt.net","threadId":"21045","inReplyTo":"26ae428a0909242310r259ccf5eya7c95b8f43fc5c23@mail.gmail.com","subject":"Re: Re: How does gitosis know who the key belongs to","fromName":"Heiko Voigt","fromEmail":"hvoigt@hvoigt.net","sentAt":"2009-09-25T06:33:14Z","receivedAt":"2009-09-25T06:33:14Z","isPatch":false,"sender":{"key":"hvoigt@hvoigt.net","avatar":"https://avatars.githubusercontent.com/u/184958?v=4"},"body":"On Fri, Sep 25, 2009 at 07:10:07AM +0100, Howard Miller wrote:\n> 2009/9/24 Matthieu Moy :\n> > Heiko Voigt writes:\n> >\n> >> On Thu, Sep 24, 2009 at 03:51:44PM +0100, Howard Miller wrote:\n> >> Not much different. It uses the command feature of the authorized_keys\n> >> file of ssh to limit access to the 'gitosis-serve' command which is\n> >> given the username from the gitosis.conf as argument.\n> >\n> > ... the username -> key association being done in gitosis's\n> > configuration itself (the key held in keydir/foobar is the one of user\n> > foobar).\n> \n> \n> Yes, I realise that the association is done im gitosis' config file,\n> but that is exactly my question - how does that association work?\n> \n> To take a step back - I have to put a name (or a name@hostname) in the\n> configuration file. How do I know what that should be in the general\n> sense?\n\nAnything you like. The username is deducted from the filename in the\nkeydir file as Matthieu alredy pointed out. e.g:\n\n keydir/hvoigt.pub\t<--- file contains my public key\n \n gitosis.conf contents:\n \n [group hvoigt-projects]\n members = hvoigt\n writable = myproject\n \nThat would give access to git@yourserver:myproject.git to the key in\nhvoigt.pub. Technically its done using a update hook on the server which\nis run when you push the configuration repository. It scans the config\nand installs the keys in the authorized_keys file of the git user. The\nabove would look something like this in the git's users home dir:\n\n .ssh/auhtorized_keys:\n \n command=\"gitosis-serve hvoigt\",no-port-forwarding,no-X11-forwarding,\\\n no-agent-forwarding,no-pty ssh-dss AAAA... hvoigt@localhost\n\nBecause ssh can match the key you are using to one of such lines the\ngitosis-serve command is given the according username.\n\nDoes this make it a little bit clearer ?\n\ncheers Heiko\n"},{"id":"123760","messageId":"vpqhburigfs.fsf@olympe.imag.fr","threadId":"21045","inReplyTo":"26ae428a0909242315x3cf1aafcue004a73f5c471450@mail.gmail.com","subject":"Re: How does gitosis know who the key belongs to","fromName":"Matthieu Moy","fromEmail":"matthieu.moy@grenoble-inp.fr","sentAt":"2009-09-25T08:20:23Z","receivedAt":"2009-09-25T08:20:23Z","isPatch":false,"sender":{"key":"matthieu.moy@grenoble-inp.fr","avatar":"https://gravatar.com/avatar/72c8a2705971a25dfaff23cece15130d405685845d911aedd5667ace277f3fc5?d=mp&s=160"},"body":"Howard Miller writes:\n\n> Ahh... just read Heiko's post properly and actually looked at the\n> authorized_keys file. This is now starting to make some sense. So the\n> name in config has to match that sent to gitosis-server presumably. I\n> still don't quite see the cause and effect. If I don't like being\n> howard@x.y.z and would rather be just 'howard' what can I change? It\n> tells me not to edit that file!\n\nIf you're confused with \"name\", then just think about \"filename\nholding the key\".\n\nIf you want to name yourself \"howard\", then put your key in\nkeydir/howard and then use \"howard\" in the config file. gitosis will\nadd the relevant\n\ncommand=\"gitosis-server howard\" ssh-whatever \n\nto the ~git/.ssh/auhtorized_keys file.\n\nYou chose your \"name\" by chosing the filename, then you use this name\nin the config file, and then gitosis does the job.\n\n-- \nMatthieu Moy\nhttp://www-verimag.imag.fr/~moy/\n"},{"id":"123761","messageId":"26ae428a0909250131k5fb04637ndbe765dce5afcc63@mail.gmail.com","threadId":"21045","inReplyTo":"vpqhburigfs.fsf@olympe.imag.fr","subject":"Re: How does gitosis know who the key belongs to","fromName":"Howard Miller","fromEmail":"howard@e-learndesign.co.uk","sentAt":"2009-09-25T08:31:46Z","receivedAt":"2009-09-25T08:31:46Z","isPatch":false,"sender":{"key":"howard@e-learndesign.co.uk","avatar":"https://gravatar.com/avatar/ddb66c6a4a077e52b823ac5b04f33ab927cb90e2ab1eafedaeba07b1920bb99e?d=mp&s=160"},"body":">\n> If you're confused with \"name\", then just think about \"filename\n> holding the key\".\n>\n> If you want to name yourself \"howard\", then put your key in\n> keydir/howard and then use \"howard\" in the config file. gitosis will\n> add the relevant\n>\n> command=\"gitosis-server howard\" ssh-whatever \n>\n> to the ~git/.ssh/auhtorized_keys file.\n>\n> You chose your \"name\" by chosing the filename, then you use this name\n> in the config file, and then gitosis does the job.\n\nOk... so is it completely ignoring the @host bit then? None of my\npublic key files are called howard@host1.pub (for example).\n\nJust so you don't think I'm completely crazy, I actually use three\ndifferent machines for development and (of course) I'm 'howard' on all\nof them. I was trying to get my head around the best way to set it up.\nI wasn't clear if I could simply recycle the same public key or if I\nneeded to be three different users in gitosis.\n\nCheers.... Howard\n"},{"id":"123770","messageId":"2e24e5b90909250501m3ba1a1f3kc83ba66db8dfb489@mail.gmail.com","threadId":"21045","inReplyTo":"26ae428a0909240751k3a799750h121935a79439b389@mail.gmail.com","subject":"Re: How does gitosis know who the key belongs to","fromName":"Sitaram Chamarty","fromEmail":"sitaramc@gmail.com","sentAt":"2009-09-25T12:01:58Z","receivedAt":"2009-09-25T12:01:58Z","isPatch":false,"sender":{"key":"sitaramc@gmail.com","avatar":"https://avatars.githubusercontent.com/u/43316?v=4"},"body":"On Thu, Sep 24, 2009 at 8:21 PM, Howard Miller\n wrote:\n> Hi,\n>\n> This is probably another one of my stupid questions.\n>\n> Gitosis obviously uses keypairs but the config file addresses the user\n> by name/host. How does gitosis connect the two together? Is it any\n> more complicated than the user detail at the end of the public key?\n>\n> The second part of my question then is is it possible to use the same\n> private key on more than one host?\n\nEverything you ever wanted to know about how gitosis and ssh work\ntogether: http://sitaramc.github.com/0-installing/9-gitosis-server-install.html\n\nVery verbose. (I've even been told it is too verbose but I chose to\nignore him ;-)\n\n-- \nSitaram\n"}]}