Re: git-shell default working directory

From: Greg Anders <greg@gpanders.com>
Date: Feb 27, 2020, 21:57 UTC
Message-ID: <20200227215715.qzxtbzvirxg3mnqv@Kepler>
In-Reply-To: <20200226203931.GA288832@coredump.intra.peff.net>

Thanks for the replies everyone!

>Disclaimer: I'm not at all familiar with git server setup. Would it 
>make sense to change git user home directory to be the required 
>dedicated directory?

I did think about this but that doesn't really solve the problem. The reason I'd like to use a dedicated directory for the repositories is so that I can separate the repos from the git user's home files (e.g. .profile, .ssh, etc.) I am also hosting an HTTP front end that reads the repos and I don't want to introduce a security risk by giving the web server access to the git user's home directory.

>Yeah, that's what I would suggest. git-shell does explicitly cd to
>$HOME, so any chdir you do before then will be lost (though you could
>perhaps just set $HOME in ~/.ssh/rc).

I did try ~/.ssh/rc, but when using git-shell it says `/bin/sh .ssh/rc: Unknown command` or something to that effect. I'm assuming this has to do with the fact that git-shell can only run a certain subset of commands (although according to the SSH docs, the rc file _should_ be executed _before_ switching to the user's $SHELL, so I'm not actually quite sure why this doesn't work).

>And I second the notion of gitolite for a dedicated setup like this (I
>haven't really used it much myself, but the design always seemed quite
>sane to me).

I'd actually never heard of gitolite before. It does look like a great piece of software, but I'm worried it might be overkill for me since I'm running just a single-user setup (i.e. me).

For now, I've just created symlinks from /srv/git into /home/git which allows cloning over SSH to work how I'd expect. I also created a interactive command under git-shell-commands/ that will create a new repository in /srv/git and also automatically generate the symlinks into /home/git. It feels a bit hacky, but it works!