{"thread":{"id":"7247","subject":"git protocol over port-forwarding","startedAt":"2007-03-14T18:37:20Z","lastAt":"2007-03-15T04:29:38Z","messageCount":10,"participants":["Bill Lear","Julian Phillips","Martin Langhoff","Jakub Narebski"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"37099","messageId":"17912.16608.852664.321837@lisa.zopyra.com","threadId":"7247","inReplyTo":null,"subject":"git protocol over port-forwarding","fromName":"Bill Lear","fromEmail":"rael@zopyra.com","sentAt":"2007-03-14T18:37:20Z","receivedAt":"2007-03-14T18:37:20Z","isPatch":false,"sender":{"key":"rael@zopyra.com","avatar":"https://gravatar.com/avatar/c4f2d2790ca3828d3b4e7dfebabf61d2fe94fd82fa49cdac2a5295dd2d46a874?d=mp&s=160"},"body":"We are attempting to use the git protocol throughout our company, as\nit saves ssh-related problems of permissions and umasks for a our\npoorly-administered community of developers, engineers, and others.\n\nThis fails, and I was wondering if anyone has any experience using\nport-forwarding and the git protocol, or if it is not presently\npossible.\n\nHere's how we set things up (\"source\" is where git-daemon runs,\nand \"xiphi\" is a client machine):\n\nOn the source machine, which is running the git daemon, and listening\non port 9418, I set up this ssh config entry in my ~/.ssh/config file:\n\nHost xiphi-git\n     Protocol 2\n     ForwardX11 yes\n     Hostname xiphi.lsscorp.com\n     RemoteForward 5700 localhost:9418\n     HostKeyAlias xiphi-git\n\nThen on source, I ssh to xiphi-git, which connects to xiphi and sets up\na portforwarding from xiphi:9418 back to source:9418.  Then, on xiphi:\n\nxiphi:~/y % git clone git://localhost:5700/fusion\nInitialized empty Git repository in /home/furnish/y/fusion/.git/\nfatal: The remote end hung up unexpectedly\nfetch-pack from 'git://localhost:5700/fusion' failed.\n\nSo, we are wondering if perhaps the git daemon could be jiggered to\nwork somehow, or if there are other options for us.\n\n\nBill\n"},{"id":"37107","messageId":"Pine.LNX.4.64.0703142057300.25422@beast.quantumfyre.co.uk","threadId":"7247","inReplyTo":"17912.16608.852664.321837@lisa.zopyra.com","subject":"Re: git protocol over port-forwarding","fromName":"Julian Phillips","fromEmail":"julian@quantumfyre.co.uk","sentAt":"2007-03-14T21:05:37Z","receivedAt":"2007-03-14T21:05:37Z","isPatch":false,"sender":{"key":"julian@quantumfyre.co.uk","avatar":"https://avatars.githubusercontent.com/u/948888?v=4"},"body":"On Wed, 14 Mar 2007, Bill Lear wrote:\n\n> We are attempting to use the git protocol throughout our company, as\n> it saves ssh-related problems of permissions and umasks for a our\n> poorly-administered community of developers, engineers, and others.\n>\n> This fails, and I was wondering if anyone has any experience using\n> port-forwarding and the git protocol, or if it is not presently\n> possible.\n>\n> Here's how we set things up (\"source\" is where git-daemon runs,\n> and \"xiphi\" is a client machine):\n>\n> On the source machine, which is running the git daemon, and listening\n> on port 9418, I set up this ssh config entry in my ~/.ssh/config file:\n>\n> Host xiphi-git\n>     Protocol 2\n>     ForwardX11 yes\n>     Hostname xiphi.lsscorp.com\n>     RemoteForward 5700 localhost:9418\n>     HostKeyAlias xiphi-git\n>\n> Then on source, I ssh to xiphi-git, which connects to xiphi and sets up\n> a portforwarding from xiphi:9418 back to source:9418.  Then, on xiphi:\n>\n> xiphi:~/y % git clone git://localhost:5700/fusion\n> Initialized empty Git repository in /home/furnish/y/fusion/.git/\n> fatal: The remote end hung up unexpectedly\n> fetch-pack from 'git://localhost:5700/fusion' failed.\n>\n> So, we are wondering if perhaps the git daemon could be jiggered to\n> work somehow, or if there are other options for us.\n\nI don't think there is anything that needs changing with the git daemon \n... or at least I was able to successfully clone over an SSH port forward.\n\nI did get the same error as you originally, but this was due to SSH \nfailing to setup the tunnel connection (checking the logs showed that I \nhad got the hostname in the forward wrong).\n\n-- \nJulian\n\n  ---\n<rac> separated by irc networks...i sense a meg ryan movie coming on\n"},{"id":"37108","messageId":"46a038f90703141407k6302cc87w27691980a65e96b5@mail.gmail.com","threadId":"7247","inReplyTo":"17912.16608.852664.321837@lisa.zopyra.com","subject":"Re: git protocol over port-forwarding","fromName":"Martin Langhoff","fromEmail":"martin.langhoff@gmail.com","sentAt":"2007-03-14T21:07:27Z","receivedAt":"2007-03-14T21:07:27Z","isPatch":false,"sender":{"key":"martin.langhoff@gmail.com","avatar":"https://gravatar.com/avatar/1e3f311b6c4c15836501901ca58f8c0b0667246488084ba524d8bc9867e22fd9?d=mp&s=160"},"body":"On 3/15/07, Bill Lear <rael@zopyra.com> wrote:\n> This fails, and I was wondering if anyone has any experience using\n> port-forwarding and the git protocol, or if it is not presently\n> possible.\n\nWe do it all the time. We have an internal server for git hosting, and\nto use git+ssh you have to be inside the firewall. If you are outside,\nyou have to run through several SSH hops to get through the firewall.\nWe automate this using ssh-agent and keys forwarding.\n\nTo get ssh to work for you transparently, what you need to do is to\nsetup a special Host entry for your git server. For example, I have a\n\nHost gitproxied.yourdomain\n    ProxyCommand ssh firewallhost \"perl -MSocket -e\n'\\$h=shift;socket(X,PF_INET,SOCK_STREAM,getprotobyname(\\\"tcp\\\"));connect(X,sockaddr_in(22,inet_aton(\\$h)));\\$x=fileno(X);vec(\\$r,\\$x,1)=1;vec(\\$r,0,1)=1;\\$|=1;\\$0=\\\"connect\nto \\$h\\\";while(1){1 until\nselect(\\$ro=\\$r,undef,\\$eo=\\$r,undef);if(vec(\\$ro,\\$x,1)){recv(X,\\$buf,2000,0);print\n\\$buf;}elsif(vec(\\$ro,0,1)){sysread(STDIN,\\$buf,2000)or\nlast;send(X,\\$buf,0);}elsif(vec(\\$eo,0,1)||vec(\\$eo,\\$x,1)){last}}'\ngit.yourdomain\"\n\nas I have several hops to go through, \"firewallhost\" has another Host\nentry, describing how to get to it.\n\nWith this, when I'm outside the lan I can ssh into the \"git\" host by\ninvoking \"ssh gitproxied.yourdomain\", sftp and scp work too. So I\noften have an \"extra\" remote called originproxied or similar.\n\ncheers,\n\n\nmartin\n"},{"id":"37118","messageId":"17912.29057.435478.123662@lisa.zopyra.com","threadId":"7247","inReplyTo":"Pine.LNX.4.64.0703142057300.25422@beast.quantumfyre.co.uk","subject":"Re: git protocol over port-forwarding","fromName":"Bill Lear","fromEmail":"rael@zopyra.com","sentAt":"2007-03-14T22:04:49Z","receivedAt":"2007-03-14T22:04:49Z","isPatch":false,"sender":{"key":"rael@zopyra.com","avatar":"https://gravatar.com/avatar/c4f2d2790ca3828d3b4e7dfebabf61d2fe94fd82fa49cdac2a5295dd2d46a874?d=mp&s=160"},"body":"On Wednesday, March 14, 2007 at 21:05:37 (+0000) Julian Phillips writes:\n>...\n>I don't think there is anything that needs changing with the git daemon \n>... or at least I was able to successfully clone over an SSH port forward.\n>\n>I did get the same error as you originally, but this was due to SSH \n>failing to setup the tunnel connection (checking the logs showed that I \n>had got the hostname in the forward wrong).\n\nOk, so were you doing something like this:\n\n% git clone git://localhost:5700/project\n\netc.?  and not using the ssh protocol, like this:\n\n% git clone ssh://...\n\n?\n\n\nBill\n"},{"id":"37119","messageId":"46a038f90703141514q5273e493r87f0ac7f52c1c216@mail.gmail.com","threadId":"7247","inReplyTo":"17912.29057.435478.123662@lisa.zopyra.com","subject":"Re: git protocol over port-forwarding","fromName":"Martin Langhoff","fromEmail":"martin.langhoff@gmail.com","sentAt":"2007-03-14T22:14:37Z","receivedAt":"2007-03-14T22:14:37Z","isPatch":false,"sender":{"key":"martin.langhoff@gmail.com","avatar":"https://gravatar.com/avatar/1e3f311b6c4c15836501901ca58f8c0b0667246488084ba524d8bc9867e22fd9?d=mp&s=160"},"body":"On 3/15/07, Bill Lear <rael@zopyra.com> wrote:\n> On Wednesday, March 14, 2007 at 21:05:37 (+0000) Julian Phillips writes:\n> >...\n> >I don't think there is anything that needs changing with the git daemon\n> >... or at least I was able to successfully clone over an SSH port forward.\n> >\n> >I did get the same error as you originally, but this was due to SSH\n> >failing to setup the tunnel connection (checking the logs showed that I\n> >had got the hostname in the forward wrong).\n>\n> Ok, so were you doing something like this:\n>\n> % git clone git://localhost:5700/project\n>\n> etc.?  and not using the ssh protocol, like this:\n>\n> % git clone ssh://...\n\nI think pure port forwarding won't support git+ssh. For that you need\nthe proxycommand approach I mentioned. Actually, I think there's a\nmore elegant approach just saying\n\nHost fooproxied\n    ProxyCommand ssh -q -a foo.yourdomain nc -q0 %h 22\n\ncheers,\n\n\n\nm\n"},{"id":"37120","messageId":"Pine.LNX.4.64.0703142225110.14109@beast.quantumfyre.co.uk","threadId":"7247","inReplyTo":"17912.29057.435478.123662@lisa.zopyra.com","subject":"Re: git protocol over port-forwarding","fromName":"Julian Phillips","fromEmail":"julian@quantumfyre.co.uk","sentAt":"2007-03-14T22:30:29Z","receivedAt":"2007-03-14T22:30:29Z","isPatch":false,"sender":{"key":"julian@quantumfyre.co.uk","avatar":"https://avatars.githubusercontent.com/u/948888?v=4"},"body":"On Wed, 14 Mar 2007, Bill Lear wrote:\n\n> On Wednesday, March 14, 2007 at 21:05:37 (+0000) Julian Phillips writes:\n>> ...\n>> I don't think there is anything that needs changing with the git daemon\n>> ... or at least I was able to successfully clone over an SSH port forward.\n>>\n>> I did get the same error as you originally, but this was due to SSH\n>> failing to setup the tunnel connection (checking the logs showed that I\n>> had got the hostname in the forward wrong).\n>\n> Ok, so were you doing something like this:\n>\n> % git clone git://localhost:5700/project\n\nyup.\n\nI was even watching netstat on the server too ... ;)\n(I did setup the tunnel from the client though, since I can't ssh into my \ndesktop machine - so I was using LocalForward 5700 <server_ip>:9418)\n\n>\n> etc.?  and not using the ssh protocol, like this:\n>\n> % git clone ssh://...\n\nnope.\n\n-- \nJulian\n\n  ---\nI want to marry a girl just like the girl that married dear old dad.\n \t\t-- Freud\n"},{"id":"37128","messageId":"et9vkm$2j4$1@sea.gmane.org","threadId":"7247","inReplyTo":"46a038f90703141514q5273e493r87f0ac7f52c1c216@mail.gmail.com","subject":"Re: git protocol over port-forwarding","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2007-03-14T23:14:32Z","receivedAt":"2007-03-14T23:14:32Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Martin Langhoff wrote:\n\n> On 3/15/07, Bill Lear <rael@zopyra.com> wrote:\n>> On Wednesday, March 14, 2007 at 21:05:37 (+0000) Julian Phillips writes:\n>>>...\n>>>I don't think there is anything that needs changing with the git daemon\n>>>... or at least I was able to successfully clone over an SSH port forward.\n>>>\n>>>I did get the same error as you originally, but this was due to SSH\n>>>failing to setup the tunnel connection (checking the logs showed that I\n>>>had got the hostname in the forward wrong).\n>>\n>> Ok, so were you doing something like this:\n>>\n>> % git clone git://localhost:5700/project\n>>\n>> etc.?  and not using the ssh protocol, like this:\n>>\n>> % git clone ssh://...\n> \n> I think pure port forwarding won't support git+ssh. For that you need\n> the proxycommand approach I mentioned. Actually, I think there's a\n> more elegant approach just saying\n> \n> Host fooproxied\n>     ProxyCommand ssh -q -a foo.yourdomain nc -q0 %h 22\n\nI think it could be done but with _two_ port forwarding, one from git\nport to ssh port or 5700 port, on your computer (probably reverse tunnel),\nsecond from 5700 port to git port... unless you configure git server\nto use different port...\n\n-- \nJakub Narebski\nWarsaw, Poland\nShadeHawk on #git\n"},{"id":"37146","messageId":"17912.38000.404237.850492@lisa.zopyra.com","threadId":"7247","inReplyTo":"et9vkm$2j4$1@sea.gmane.org","subject":"Re: git protocol over port-forwarding","fromName":"Bill Lear","fromEmail":"rael@zopyra.com","sentAt":"2007-03-15T00:33:52Z","receivedAt":"2007-03-15T00:33:52Z","isPatch":false,"sender":{"key":"rael@zopyra.com","avatar":"https://gravatar.com/avatar/c4f2d2790ca3828d3b4e7dfebabf61d2fe94fd82fa49cdac2a5295dd2d46a874?d=mp&s=160"},"body":"On Thursday, March 15, 2007 at 00:14:32 (+0100) Jakub Narebski writes:\n>...\n>I think it could be done but with _two_ port forwarding, one from git\n>port to ssh port or 5700 port, on your computer (probably reverse tunnel),\n>second from 5700 port to git port... unless you configure git server\n>to use different port...\n\nOk thanks to all, Jakub, Martin, Julian, for the comments.  I'll\ngo give our ssh \"expert\" hell.\n\n\nBill\n"},{"id":"37148","messageId":"17912.41540.361226.683146@lisa.zopyra.com","threadId":"7247","inReplyTo":"17912.38000.404237.850492@lisa.zopyra.com","subject":"Re: git protocol over port-forwarding","fromName":"Bill Lear","fromEmail":"rael@zopyra.com","sentAt":"2007-03-15T01:32:52Z","receivedAt":"2007-03-15T01:32:52Z","isPatch":false,"sender":{"key":"rael@zopyra.com","avatar":"https://gravatar.com/avatar/c4f2d2790ca3828d3b4e7dfebabf61d2fe94fd82fa49cdac2a5295dd2d46a874?d=mp&s=160"},"body":"On Wednesday, March 14, 2007 at 18:33:52 (-0600) Bill Lear writes:\n>On Thursday, March 15, 2007 at 00:14:32 (+0100) Jakub Narebski writes:\n>>...\n>>I think it could be done but with _two_ port forwarding, one from git\n>>port to ssh port or 5700 port, on your computer (probably reverse tunnel),\n>>second from 5700 port to git port... unless you configure git server\n>>to use different port...\n>\n>Ok thanks to all, Jakub, Martin, Julian, for the comments.  I'll\n>go give our ssh \"expert\" hell.\n\nJust wanted to confirm to all that our expert confessed that he had\nfat-fingered something (I promise, it wasn't me), and now it works\nperfectly.\n\nThanks again.\n\n\nBill\n"},{"id":"37149","messageId":"46a038f90703142129q55254a98na3341da0b6a0319b@mail.gmail.com","threadId":"7247","inReplyTo":"et9vkm$2j4$1@sea.gmane.org","subject":"Re: git protocol over port-forwarding","fromName":"Martin Langhoff","fromEmail":"martin.langhoff@gmail.com","sentAt":"2007-03-15T04:29:38Z","receivedAt":"2007-03-15T04:29:38Z","isPatch":false,"sender":{"key":"martin.langhoff@gmail.com","avatar":"https://gravatar.com/avatar/1e3f311b6c4c15836501901ca58f8c0b0667246488084ba524d8bc9867e22fd9?d=mp&s=160"},"body":"On 3/15/07, Jakub Narebski <jnareb@gmail.com> wrote:\n> I think it could be done but with _two_ port forwarding, one from git\n> port to ssh port or 5700 port, on your computer (probably reverse tunnel),\n> second from 5700 port to git port... unless you configure git server\n> to use different port...\n\nAll the protections against man-in-the-middle attacks (host key\nverification, etc) prevent straight port forwarding. That's why if you\nwant git over ssh you have to use the proxycommand option to ssh.\n\nIMHO, YMMV, etc. ;-)\n\n\n\nm\n"}]}