3 ms·
Security question. Can `git-shell` restrict users to their remote home directory? Or if you give me a git shell, can I still do things like `git clone me@exampl
by sigil 10y ago
Security question. Can `git-shell` restrict users to their remote home directory? Or if you give me a git shell, can I still do things like `git clone me@example.com:/home/you/secret-sauce` ?
This is only an issue if you're sharing the box and/or remote repositories with other people. For shared remote repositories I've been using the following setup:
1. Create a bare, shared repository at `/var/git/foo`. Configure unix group permissions and the directory setuid bit on it.
2. Give alice access via a `/home/alice/foo -> /var/git/foo` symlink.
3. Set alice's shell to a patched version of the git shell I call `git-home-shell` that sanitizes the repository path argument and makes it relative to her home dir.
Is there a better way these days?
- Symbiote 10y agoWhy not just set standard file permissions (owner and group)? You could create a group for each repository, and add and remove members as necessary.
- sigil 10y agoThis is precisely what I do. But, I'd prefer it if git-shell didn't let users probe and read git repositories at any absolute path on the remote end. That's not great behavior for a restricted shell.
- stephenr 10y agoRemove the 'others' read/execute permission from user home directories.
- sigil 10y agoSure, but there might be git repos sitting around elsewhere. Why risk exposing a git repo literally anywhere in the filesystem to a restricted shell account?
- stephenr 10y agoThen use a chroot.
- sigil 10y agoYou could do that, but that means for a shared repo and N git shell accounts you've got N chroots, presumably using null or bind mounts. That's a lot more work than a restricted shell which just...restricts.
- stephenr 10y agoTrue, it all depends what your requirements are. Personally I'd just designate a path for shared repos (e.g. /srv/vcs/<project>{.git,.hg} etc), give people write access using ACLs and group membership. If they create repos in their home directories, thats their business.
- dfox 10y agoFor multi-user use probably best solutions are scripts/systems that automate this whole thing like gitosis and gitolite. You get multiple users logging in as same system user which are authenticated by their SSH key and administration of the thing is mostly performed by commiting into special git repository.
- sigil 10y agoThanks for that. The gitosis approach of a single shared unix account (typically `git`) with git-shell and a master authorized_keys file definitely seems simpler. You lose some of the auditing and security benefits of the one-unix-account-per-human approach, but that might be fine for some use cases.