Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up a git post-update hook for my gitosis repository to update a working copy on a remote server. What's the best and most secure way to run a script on the remote server without requiring authentication, since the hook will be running as the gitosis user on one machine, which doesn't have a counterpart on the other machine.

I considered using a public/private keypair without a passphrase, which is what I use to have the script automatically update the working copy on the local server (for gitosis, not ssh), but I'm a little hesitant to use the same key for authentication via ssh since if the private key is somehow compromised an attacker could log in without authenticating. Or am I worrying too much, and is this something that permissions will take care of anyway (private key must be chmod 0600)?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

The "best and most secure way" is probably to do a git pull when you use the remote server's working copy, or add the server as a git "remote" & push to it simultaneously.

As an alternative the passwordless public key thing will work. I would suggest using a different key than you use for anything else & setting up SSH to only allow forced commands when you log in with that key (add command="...." to the options part of authorized_keys assuming you're using OpenSSH), that way even if your key is compromised all they can do is update your git repository.

share|improve this answer
    
Awesome thanks, that's what I wanted know. And anyway, it's not going to be my own just a randomly generated key for the gitosis user. –  Ibrahim Mar 12 '10 at 19:34
add comment

I think the private/public key way is the most common one to do such things. I would make it the same way.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.