Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've got a user that I'd like to only be able to use subversion. We like to use svn+ssh:// URLs sometimes (for public keys and whatnot), so I need them to be able to connect over ssh and run only the svnserve command.

When using a svn+ssh URL, svn ssh'es in and passes the arguments "-c svnserve -t". I wrote a custom shell as follows to filter the commands that can be run. This works, but it's not passing the input to svnserve, so when I try to "svn up" I get "svn: Connection closed unexpectedly".

#!/bin/bash
if [ "$1" == "-c" ] && [ "$2" == "svnserve" ] && [ "$3" == "-t" ] && [ "$4" == ""] ; then
        exec svnserve -t
else
        echo "Access denied. User may only run svnserve."
fi
share|improve this question
    
You should be aware that your test allows calls such as -c svnserve -t "" somethingmore. Instead of checking for $4 to be null, you should check for the arg count. if [ "$1" == "-c" ] && [ "$2" == "svnserve" ] && [ "$3" == "-t" ] && [ $# = 3 ] –  Dennis Williamson Mar 17 '10 at 22:24

2 Answers 2

up vote 4 down vote accepted

I am pretty sure you could put something like this at the end of your sshd_config.

Match User svnuser
  ForceCommand svnserve -t
share|improve this answer
    
That works, thanks! –  sbleon Mar 19 '10 at 13:49

In the file authorized_keys add the line command="svnserve" and whatnot at the beginning of his key. In this way when he connect with ssh it will run that command then exit, e.g.

command="svnserve" ssh-rsa AAA...LONG AND TEDIOUS KEY...== user@localhost

check man sshd and the subversion documentation for details

share|improve this answer
    
We're not necessarily using public key auth, but thanks for the suggestion. –  sbleon Mar 19 '10 at 13:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.