2

I'm setting up a Git server, and there will be three different groups working on different projects iOS, WebDevel, Android. I need to do it in a secure/safe way.

Meanwhile, I don't want iOS developers to be able to change Android stuff, or vice versa. In other words, I want to restrict any group only to their own project. ( Read permission is not an issue, but if you can tell me how I can restrict read permission too, I'll be thankful )

I need your help in configuring the server in a way that Developers can use pull/push/commit through SSH via their public key, but ONLY for their own project! Is there a way to jail them to their own project repo directory? For instance, is there a way to say whenever X user with the public key of x_id_rsa.pub or with the request of git@mygitserver.com:~/git/iOS trying to push or pull data, should be jailed to iOS?

And the final question is that how can I use different type of policies for each repo directory by SELinux?

I'm using CentOS, and here you can see my unsuccessful - and ridiculous - attempts:

  1. Created a user called git, and assigned 3 groups to user git.
    • iOS
    • Android
    • WebDevel
  2. Created 3 needed directories, and user chown git:$ProjectGroup $Dir
  3. Used chmod g+rwxs * on directories.
  4. Changed my sshd_conf to refuse password for authenticity and enabled [Pubkey/RSA]Authentication.
  5. Created a .ssh/authorized_keys and put in /home/git/.
  6. Used git init --bare in all directories put under git user's home directory, I.e. iOS, Android, and WebDevel.
  7. I've got confused!

Please explain in details, and tell me what I should change and what I was wrong about. I'm open to any suggestion.

Is it possible to use any repository as group's home directory? I.e. iOS → $HOME=/home/git/iOS

  • git init --bare is not for creating a server repository? is not simple git --init that you want? – Luciano Andress Martini Sep 6 '16 at 11:58
  • @LucianoAndressMartini I seriously have no idea, that's what I was told. Please give an asnwer if you know how I can have a git server with multiple repositories inside, and restrict users loggin in with ssh only to their own directory. Thanks. – Parsa Samet Sep 6 '16 at 12:17
  • Perhaps it would be better if you take a look at Gitolite: gitolite.com/gitolite/index.html – Martin Sugioarto Sep 6 '16 at 21:00
  • @MartinSugioarto Thanks I appreciate your help, but I know how I can achieve my goal by using a third-party or whatsoever. GitLab, Tower, etc. I just need to know how to do it by myself in administration field, and I've got badly confused :( ... Anyway, thanks. – Parsa Samet Sep 7 '16 at 3:52
  • Gitolite is very small. It hosts its configuration (also in a Git repo) that associates keys to repos and allows access to a central Git repo using 1 SSH user and many keys. This is what you actually wanted and doing manually. There is a chapter in the Git book about it, because the tool is very small. Above you are doing more administration than what you would get with Gitolite. – Martin Sugioarto Sep 7 '16 at 5:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.