4

It is surprisingly difficult to find information on this simple problem.

Like many people we run a gitlabs/gogs server on a remote instance. Currently it listens on port 10022. We also run ssh on that instance to administer the server. It listens on port 22.

We'd like the ssh server listening on port 22 to forward connections for Git@ ONLY to the Git server on 10022.

That way when people use Git locally, they won't have to manually specify the port of our remote Git server each time.

How can we do this?

1

I have never done that but maybe this does what you want:

You can put a Match block for the user git in sshd_config which contains ForceCommand. The forced command can be an ssh login to the real server. You can use public key authentication without passphrase so the users might not even notice this.

  • Can we not forward the user's own public key auth token? The public key authentications and the repos they allow access to are managed by the git server itself -- just like github. – DMCoding Feb 7 '16 at 13:59
  • No, it is not possible with openssh. As late as you are in Match block, you can't redirect the connection to different ssh server. – Jakuje Feb 7 '16 at 15:14
1

A simpler approach would be:

Just tell your users to add an alias for your git-server to the ~/.ssh/config. Then they have the same convenience as with github and you don't have to do some weird redirections on the server side.

For example:

# put into ~/.ssh/config
Host mygitlab
Hostname git.example.org
Port 10022

Then your users can just clone etc. like this:

$ git clone mygitlab:someuser/somerepo.git
  • They are users, not administrators so that would not in any way be simpler. I really dont see how this is a weird idea -- what do github, bitbucket, etc. do? You're telling me they don't use SSH to administer their server fleet just because that port happens to be taken by their git software? – DMCoding Feb 7 '16 at 21:49
  • @DanielJames probably they use a different port for admin? – nafg Mar 31 '17 at 5:53
  • @nafg, doubtful when there's a more elegant way. You have a list of git users and a list of shell users. Shell users are allowed to use their default shell, git users are forced to use a special git shell binary which only allows git commands. Not difficult, not complicated, not hard to understand. Gitlabs do it (gitlab.com/gitlab-org/gitlab-shell) I'd bet money github does as well. – DMCoding Mar 31 '17 at 18:16
0

the solution lies in the gitlab GUI: just click on the clone button, and paste in the command line.

$ git clone ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git

and you can verify everything is correct with:

$ git remote -v
origin  ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git (fetch)
origin  ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git (push)
  • How does this address the question? – RalfFriedl Mar 21 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.