Re: git + ssh + key authentication feature-request

From: Linus Torvalds <torvalds@osdl.org>
Date: Feb 8, 2006, 22:45 UTC
Message-ID: <Pine.LNX.4.64.0602081438390.2458@g5.osdl.org>
In-Reply-To: <43EA7D57.7040409@iaglans.de>

On Thu, 9 Feb 2006, Nicolas Vilz 'niv' wrote:

Show 5 quoted lines

> 
> in my case it would be only one system-user which has full access to several
> repositories. At this time, the users which use that account, have to give a
> password, which isn't that bad... it would be easier and more secure for me,
> not to give a password, but ask the users for the ssh pubkey..

That is very much part of how the whole git-shell usage was envisioned.

Create a "project" account on some shared machine, create the project(s) in that accounts home directory, and set the login shell for that project to "git-shell".

Then you ask people who are part of the project to send in some ssh key for that project. Then add those keys to the authorized_keys2 file for the project, and voila, you all your participants can pull and push into it but do not get any other access to the machine.

It _should_ all work perfectly fine. There are features you may want to add, like logging (but sshd does some of that for you) and various "admin" commands in addition to just plain push/pull. git-shell was really just a quick hack, and I don't know if anybody actually uses it.

In other words, it hasn't exactly been tested,

		Linus