3 ms·
This is precisely what I do. But, I'd prefer it if git-shell didn't let users probe and read git repositories at any absolute path on the remote end. That's no
by sigil 10y ago
This is precisely what I do.
But, I'd prefer it if git-shell didn't let users probe and read git repositories at any absolute path on the remote end. That's not great behavior for a restricted shell.
- stephenr 10y agoRemove the 'others' read/execute permission from user home directories.
- sigil 10y agoSure, but there might be git repos sitting around elsewhere. Why risk exposing a git repo literally anywhere in the filesystem to a restricted shell account?
- stephenr 10y agoThen use a chroot.
- sigil 10y agoYou could do that, but that means for a shared repo and N git shell accounts you've got N chroots, presumably using null or bind mounts. That's a lot more work than a restricted shell which just...restricts.
- stephenr 10y agoTrue, it all depends what your requirements are. Personally I'd just designate a path for shared repos (e.g. /srv/vcs/<project>{.git,.hg} etc), give people write access using ACLs and group membership. If they create repos in their home directories, thats their business.