Re: Git Server Repository Security?

From: John McIntyre <joh98.mac@gmail.com>
Date: May 18, 2015, 10:58 UTC
Message-ID: <CABQ4iYgjtdw46Psow_e7uGLqx0ZiFt+TQOgXvCmP1-W10LGEmg@mail.gmail.com>
In-Reply-To: <20150518102633.GA15186@book.hvoigt.net>

2015-05-18 11:26 GMT+01:00 Heiko Voigt <hvoigt@hvoigt.net>:

Show 18 quoted lines

> Hi,
>
> On Mon, May 18, 2015 at 11:07:02AM +0100, John McIntyre wrote:
>> Hi,
>> I've been asked to set up a git repository for a few projects.  So I
>> have a Linux CentOS server running git.   I place the repositories
>> under /opt and I use the .ssh/authorized_keys of the git user, to
>> grant access. The user sends me his private key, and I paste it into
>> the end of the file.
>>
>> And now, I realise that there's a problem.  If I have /opt/repo1.git
>> and /opt/repo2.git, then all users can access both repositories.
>>
>> Is there a way to prevent this?
>
> If you want a simple tool using ssh-keys have a look at gitolite[1].
> It quite simple to setup and with it you can specify all kinds of access
> rights.

That's adding a separate level of complexity.

I looked into filesystem-level permissions. I don't see any means of doing so, because everyone accesses the repositories using the 'git' user. So even if I add a group like 'devClient1' and then change the group ownership of a repo to that user, they'll still be able to access all repos..?

John.