Re: Question around git-shell usage in Everyday Git
- From
Alan Chandler <alan@chandlerfamily.org.uk>
- Date
- Feb 2, 2006, 05:17 UTC
- Message-ID
- <200602020517.05827.alan@chandlerfamily.org.uk>
- In-Reply-To
- <Pine.LNX.4.64.0602011530530.21884@g5.osdl.org>
On Wednesday 01 February 2006 23:37, Linus Torvalds wrote:
Show 19 quoted lines
> On Wed, 1 Feb 2006, Junio C Hamano wrote:
> > Do you mean to reuse single directory /home/gitu/ for user A, B, C,
> > and hang repositories /home/gitu/{X,Y,Z} for projects? I'd
> > imagine things could be arranged that way. User A and B but not
> > C may be in "projectX" group and /home/gitu/X is writable only
> > by projectX group members and such...
>
> That would work from a _git_ angle, but I don't think that was what Alan
> was talking about, and it would failr horribly from a "ssh" perspective
> (because "ssh" will want $HOME/.ssh/authorized_keys etc).
>
> So I _think_ what Alan was describing was just a
>
> /home/user-A/project.git
> another-project.git
> ya-project.git
> user-B/myproject.git
> user-C/..
>Actually Junio was right in layout - but I am not sure he understands what I want to achieve.
What I have in mind is that I am a personal developer at home with my own server. I have written various code in a number of projects whose public repositories are all located under /var/lib/git. (ie /var/lib/git/projectA.git, /var/lib/git/projectB.git) and they are all shareable.
git-daemon is run with base-path as /var/lib/git and have defined user "git" to have a home directory of /var/lib/git and git-shell as his shell, so anyone can clone from them
So, if my projects take off, and I have some outside developers helping me, I do not want to give them individual home directories on my server instead my plan_had_ been to collect their public keys at put them in /var/lib/git/.ssh/authorized_keys, and then tell them to push to the repository via
URL:git@home.chandlerfamily.org.uk:projectA.git
etc.
The downside of this approach is that all developers get access to all repositories - maybe I need better control.
Then I saw the howto on repository control with the update hook and was thinking that I could do it as follows
in /etc/password create an entry for each developer with a home directory of /var/lib/git and git shell. (so I DO NOT create a large number of /home directories at all) and make them members of group git.
Then each developer would access the repository via
URL:home.chandlerfamily.org.uk:projectx.git
but would be only allowed access if they were on a white list within each project.
Thats when I asked the question that started this thread.
Since then I have realised that the downside of this is that its pretty easy to fake being someone else and getting access by just giving someone elses name.
So the third approach I am now contemplating is to actually create separate users for each project
so user projectA had a home directory of /var/lib/git/projectA.git with a subdirectory of .ssh for the authorized keys file.
Super users (e.g. ME) would have their keys in /var/lib/git/.ssh/authorized_keys
Individual project developers would have their keys in
/var/lib/git/projectA.git/.ssh/authorized_keys etc
and would access the repository with
URL:ProjectA@home.chandlerfamily.org.uk:.
-- Alan Chandler http://www.chandlerfamily.org.uk Open Source. It's the difference between trust and antitrust.