Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to allow some users to read/write Bazaar repositories on a server using ssh.

I read about using bzr_ssh_path_limiter (with restricted ssh keys) which is a nice tool and seems to do the work. I've also seen that it is possible to use sftp for bazaar.

  • Is bazaar ("bzr serve") secure enough that the client cannot execute any shell commands?
  • Should I use sftp? Can I restrict access to a folder? and disallow shell commands?
share|improve this question
up vote 0 down vote accepted

Well, while I am inclined to trust the combination of bzr serve and ssh, there is still a lot less "moving parts" in an OpenSSH SFTP chroot. Hence, a lot less thing which could go wrong, or which could be exploited.

The potential problem with running bazaar against SFTP is that is relatively slow. Whatever that is a problem or not depends on what kind of repositories you will be sharing. Yet, if you are worried about security, then I think you should at least try the SFTP-chroot solution, to see whatever it is feasible or not.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.