3 ms·

Do most installations create a git user account with login permissions?

inigyou 2mo ago
There's no such thing as an account with or without login permissions. Normally you need a git account. And that means you can log in to it. And then you have to try and configure your ssh server so that after logging into the git account, you can only run the git server (I forget the command). If a mistake is made with this configuration then you can log in or port forward or X forward or file transfer as git. This is a terrible idea because it's blacklist-based security. Places like GitHub have their own ssh server that only runs the git server and nothing else.
- 0cf8612b2e1e 2mo ago
  I suppose /usr/sbin/nologin is not a thing? https://www.man7.org/linux/man-pages/man8/nologin.8.html https://www.man7.org/linux/man-pages/man8/nologin.8.html
  - inigyou 2mo ago
    That's a hack. It's a login shell that, once you have already logged in and run the shell, prints a message saying you can't log in or run a shell, and then exits. It does not stop you from, say, logging in to SSH and then starting a port forward. Or running a command in a way that bypasses the login shell. ssh will always pass it to your login shell but other ways can be vulnerable.
    - Bender 2mo ago
      Do you have a script to show us how it works? Here, use Claude's login [1]. There's no password. I am not very technical so let me know if I should set a password on that account. I trust everyone here. [1] - sftp ai@nochan.net
      - BenjiWiebe 2mo ago
        Doesn't seem to allow port forwarding so I think you're probably good.
  - trucks-refinish 2mo ago
    git-shell is actually made for this exact situation. it does allow uploading git repos I think so you can't open it to the public, maybe there's a way to configure it though to not allow that.
- tuetuopay 2mo ago
  SSH bastions would like a word I guess. You can authenticate, but you definitely can’t login (which is also the case for git over SSH).
  - kpcyrd 2mo ago
    An SSH bastion host allows to request direct-tcpip channels, but is going to restrict other channel types, like pty requests, shell requests, exec requests or other subsystems. The "login permission" term is confusing because it's likely supposed to mean "shell requests", but SSH channel requests in general are all post auth, which could also be considered a "login". In OpenSSH you still need to explicitly configure permitted channel requests, which I think is what GP is referring to. For git specifically I would recommend the ForceCommand feature in OpenSSH, all exec requests are then forwarded to this program, with $SSH_ORIGINAL_COMMAND set to the original command. You may then use an allow-list of commands you want to permit.

There's no such thing as an account with or without login permissions. Normally you need a git account. And that means you can log in to it. And then you have to try and configure your ssh server so that after logging into the git account, you can only run the git server (I forget the command). If a mistake is made with this configuration then you can log in or port forward or X forward or file transfer as git. This is a terrible idea because it's blacklist-based security. Places like GitHub have their own ssh server that only runs the git server and nothing else.

0cf8612b2e1e 2mo ago
I suppose /usr/sbin/nologin is not a thing? https://www.man7.org/linux/man-pages/man8/nologin.8.html https://www.man7.org/linux/man-pages/man8/nologin.8.html
- inigyou 2mo ago
  That's a hack. It's a login shell that, once you have already logged in and run the shell, prints a message saying you can't log in or run a shell, and then exits. It does not stop you from, say, logging in to SSH and then starting a port forward. Or running a command in a way that bypasses the login shell. ssh will always pass it to your login shell but other ways can be vulnerable.
  - Bender 2mo ago
    Do you have a script to show us how it works? Here, use Claude's login [1]. There's no password. I am not very technical so let me know if I should set a password on that account. I trust everyone here. [1] - sftp ai@nochan.net
    - BenjiWiebe 2mo ago
      Doesn't seem to allow port forwarding so I think you're probably good.
- trucks-refinish 2mo ago
  git-shell is actually made for this exact situation. it does allow uploading git repos I think so you can't open it to the public, maybe there's a way to configure it though to not allow that.
tuetuopay 2mo ago
SSH bastions would like a word I guess. You can authenticate, but you definitely can’t login (which is also the case for git over SSH).
- kpcyrd 2mo ago
  An SSH bastion host allows to request direct-tcpip channels, but is going to restrict other channel types, like pty requests, shell requests, exec requests or other subsystems. The "login permission" term is confusing because it's likely supposed to mean "shell requests", but SSH channel requests in general are all post auth, which could also be considered a "login". In OpenSSH you still need to explicitly configure permitted channel requests, which I think is what GP is referring to. For git specifically I would recommend the ForceCommand feature in OpenSSH, all exec requests are then forwarded to this program, with $SSH_ORIGINAL_COMMAND set to the original command. You may then use an allow-list of commands you want to permit.