I'm setting up a Git server, and there will be three different groups working on different projects iOS, WebDevel, Android. I need to do it in a secure/safe way.
Meanwhile, I don't want iOS developers to be able to change Android stuff, or vice versa. In other words, I want to restrict any group only to their own project. ( Read permission is not an issue, but if you can tell me how I can restrict read permission too, I'll be thankful )
I need your help in configuring the server in a way that Developers can use pull/push/commit through SSH via their public key, but ONLY for their own project! Is there a way to jail them to their own project repo directory? For instance, is there a way to say whenever X user with the public key of x_id_rsa.pub
or with the request of [email protected]:~/git/iOS
trying to push or pull data, should be jailed to iOS?
And the final question is that how can I use different type of policies for each repo directory by SELinux?
I'm using CentOS, and here you can see my unsuccessful - and ridiculous - attempts:
- Created a user called git, and assigned 3 groups to user git.
- iOS
- Android
- WebDevel
- Created 3 needed directories, and user
chown git:$ProjectGroup $Dir
- Used
chmod g+rwxs *
on directories. - Changed my sshd_conf to refuse password for authenticity and enabled [Pubkey/RSA]Authentication.
- Created a
.ssh/authorized_keys
and put in/home/git/
. - Used
git init --bare
in all directories put under git user's home directory, I.e. iOS, Android, and WebDevel. - I've got confused!
Please explain in details, and tell me what I should change and what I was wrong about. I'm open to any suggestion.
Is it possible to use any repository as group's home directory? I.e. iOS → $HOME=/home/git/iOS