{"thread":{"id":"5584","subject":"Setting up Password protected repositories?","startedAt":"2006-09-17T00:52:53Z","lastAt":"2006-09-17T16:43:47Z","messageCount":7,"participants":["Jon Loeliger","Junio C Hamano","Shawn Pearce","J. Bruce Fields"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"27029","messageId":"E1GOktx-0005JY-ER@jdl.com","threadId":"5584","inReplyTo":null,"subject":"Setting up Password protected repositories?","fromName":"Jon Loeliger","fromEmail":"jdl@jdl.com","sentAt":"2006-09-17T00:52:53Z","receivedAt":"2006-09-17T00:52:53Z","isPatch":false,"sender":{"key":"jdl@jdl.com","avatar":"https://gravatar.com/avatar/75ce9a10b151acd2c28ec4ab2136dba7b2ff1634530bd04b155981a749d08a64?d=mp&s=160"},"body":"So at the risk of asking a dead-stupid question for which\nI should likely be soundly beaten for even asking...\n\nHow does one set up a git repository on a public site\nbut password/ssh protected it so that only a few trusted\npeople can access and update it?\n\nClearly, we should be using ssh+git: here somehow, right?\ngit-daemon has to know where to server out the files from,\nbut how do we get it to enforce a ssh-based access?  It's\neasy to prevent http: from serving out the repository --\njust place it outside of the webroot directory structure.\n\nI can already enforce pushes to be password protected,\nbut the protection on pulls and clones eludes me.  I'd\nalso like to NOT grant login shell access on the repository\nserver machine, so I'm envisioning placing pubic keys from\ntrusted people somewhere too...\n\nI feel like I am being blindly stupid here.\n\nAny help for the weary?\n\nThanks,\njdl\n"},{"id":"27031","messageId":"7virjn8eua.fsf@assigned-by-dhcp.cox.net","threadId":"5584","inReplyTo":"E1GOktx-0005JY-ER@jdl.com","subject":"Re: Setting up Password protected repositories?","fromName":"Junio C Hamano","fromEmail":"junkio@cox.net","sentAt":"2006-09-17T01:24:45Z","receivedAt":"2006-09-17T01:24:45Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jon Loeliger <jdl@jdl.com> writes:\n\n> git-daemon has to know where to server out the files from,\n> but how do we get it to enforce a ssh-based access?  It's\n> easy to prevent http: from serving out the repository --\n> just place it outside of the webroot directory structure.\n\nIt all depends on how you start git-daemon, but the last\nparameters to git-daemon are path whitelist so presumably\nplacing the private repository outside of it should be enough.\n\nOr am I missing something deeper?\n"},{"id":"27034","messageId":"E1GOm3h-0005jq-5u@jdl.com","threadId":"5584","inReplyTo":"7virjn8eua.fsf@assigned-by-dhcp.cox.net","subject":"Re: Setting up Password protected repositories?","fromName":"Jon Loeliger","fromEmail":"jdl@jdl.com","sentAt":"2006-09-17T02:07:01Z","receivedAt":"2006-09-17T02:07:01Z","isPatch":false,"sender":{"key":"jdl@jdl.com","avatar":"https://gravatar.com/avatar/75ce9a10b151acd2c28ec4ab2136dba7b2ff1634530bd04b155981a749d08a64?d=mp&s=160"},"body":"So, like, the other day Junio C Hamano mumbled:\n> \n> It all depends on how you start git-daemon, but the last\n> parameters to git-daemon are path whitelist so presumably\n> placing the private repository outside of it should be enough.\n> \n> Or am I missing something deeper?\n\nI want git-daemon to serve up the repository.\nI just want to have it served to people who can\nsupply a password or have an ssh key in place.\n\njdl\n"},{"id":"27037","messageId":"7v8xkj8ccy.fsf@assigned-by-dhcp.cox.net","threadId":"5584","inReplyTo":"E1GOm3h-0005jq-5u@jdl.com","subject":"Re: Setting up Password protected repositories?","fromName":"Junio C Hamano","fromEmail":"junkio@cox.net","sentAt":"2006-09-17T02:18:21Z","receivedAt":"2006-09-17T02:18:21Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jon Loeliger <jdl@jdl.com> writes:\n\n> So, like, the other day Junio C Hamano mumbled:\n>> \n>> It all depends on how you start git-daemon, but the last\n>> parameters to git-daemon are path whitelist so presumably\n>> placing the private repository outside of it should be enough.\n>> \n>> Or am I missing something deeper?\n>\n> I want git-daemon to serve up the repository.\n> I just want to have it served to people who can\n> supply a password or have an ssh key in place.\n\nSorry, git-daemon was written as anonymous download service from\nthe beginning and there is no provision for something like that\nin place (as you probably have noticed when you hacked on it\nrecently ;-)).\n\nLetting them ssh-in, and if you do not trust them giving them\ngit-shell as their login shell, might be an option.  I do not\nthink of anything else offhand that is already available.\n"},{"id":"27038","messageId":"20060917022013.GA7512@spearce.org","threadId":"5584","inReplyTo":"E1GOm3h-0005jq-5u@jdl.com","subject":"Re: Setting up Password protected repositories?","fromName":"Shawn Pearce","fromEmail":"spearce@spearce.org","sentAt":"2006-09-17T02:20:14Z","receivedAt":"2006-09-17T02:20:14Z","isPatch":false,"sender":{"key":"spearce@spearce.org","avatar":"https://avatars.githubusercontent.com/u/34844?v=4"},"body":"Jon Loeliger <jdl@jdl.com> wrote:\n> So, like, the other day Junio C Hamano mumbled:\n> > \n> > It all depends on how you start git-daemon, but the last\n> > parameters to git-daemon are path whitelist so presumably\n> > placing the private repository outside of it should be enough.\n> > \n> > Or am I missing something deeper?\n> \n> I want git-daemon to serve up the repository.\n> I just want to have it served to people who can\n> supply a password or have an ssh key in place.\n\nDon't use git-daemon.\n\nInstead create UNIX accounts for the people who need access and if\nyou don't want them to actually be able to login set their shell\nto be `git-sh`.  This is a special shell-like thing that only lets\nthe user push or fetch to any repository they have access to.\n\nThe URL is a 'git+ssh' style URL and they will use SSH to connect.\n\nAccess is controlled by standard UNIX user/group read/write access\nand ACLs if your OS/filesystem support them.  You can also control\npushing with an update hook.\n\n-- \nShawn.\n"},{"id":"27080","messageId":"E1GOzP9-0001Fn-G8@jdl.com","threadId":"5584","inReplyTo":"20060917022013.GA7512@spearce.org","subject":"Re: Setting up Password protected repositories?","fromName":"Jon Loeliger","fromEmail":"jdl@jdl.com","sentAt":"2006-09-17T16:22:03Z","receivedAt":"2006-09-17T16:22:03Z","isPatch":false,"sender":{"key":"jdl@jdl.com","avatar":"https://gravatar.com/avatar/75ce9a10b151acd2c28ec4ab2136dba7b2ff1634530bd04b155981a749d08a64?d=mp&s=160"},"body":"So, like, the other day Shawn Pearce mumbled:\n> > > \n> > > Or am I missing something deeper?\n\nHmmm... Maybe _I_ am!...\n\n> > I want git-daemon to serve up the repository.\n> > I just want to have it served to people who can\n> > supply a password or have an ssh key in place.\n> \n> Don't use git-daemon.\n\nSay that again?  It sounded like you said \"Don't use git-daemon.\"\n\n> Instead create UNIX accounts for the people who need access and if\n> you don't want them to actually be able to login set their shell\n> to be `git-sh`.  This is a special shell-like thing that only lets\n> the user push or fetch to any repository they have access to.\n\nYeah, I think I'm getting it now.  Don't use git-daemon, and\ninstead set up UNIX accounts with git-sh as their shell.  That\nwill let them push and fetch from a repository they can access.\n\n> The URL is a 'git+ssh' style URL and they will use SSH to connect.\n\nAhhh...  Straight ssh to git-sh, no git daemon or HTTP in the mix.\n\n> Access is controlled by standard UNIX user/group read/write access\n> and ACLs if your OS/filesystem support them.  You can also control\n> pushing with an update hook.\n\nOK.  I seem to recall a recipe down this line somwhere...  Is there\na current \"Best Practices\" write up somewhere with these details\noutlined in it?\n\nSo slowly we are clued...\n\nThanks,\njdl\n"},{"id":"27082","messageId":"20060917164347.GA21710@fieldses.org","threadId":"5584","inReplyTo":"E1GOzP9-0001Fn-G8@jdl.com","subject":"Re: Setting up Password protected repositories?","fromName":"J. Bruce Fields","fromEmail":"bfields@fieldses.org","sentAt":"2006-09-17T16:43:47Z","receivedAt":"2006-09-17T16:43:47Z","isPatch":false,"sender":{"key":"bfields@citi.umich.edu","avatar":null},"body":"On Sun, Sep 17, 2006 at 11:22:03AM -0500, Jon Loeliger wrote:\n> So, like, the other day Shawn Pearce mumbled:\n> > Access is controlled by standard UNIX user/group read/write access\n> > and ACLs if your OS/filesystem support them.  You can also control\n> > pushing with an update hook.\n> \n> OK.  I seem to recall a recipe down this line somwhere...  Is there\n> a current \"Best Practices\" write up somewhere with these details\n> outlined in it?\n\nThere's a few sentences in Documentation/cvs-migration.txt, and a little\nmore in Documentation/howto/update-hook-example.txt\n\n--b.\n"}]}