Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've set up a Mercurial server on a Linux machine and it works fine. Users can, for example, push and pull to it using something like:

hg push ssh://...

Users can also ssh into the server.

For some users I'd like to restrict the access to they can only access Mercurial.

How would I go about this?

share|improve this question
    
If you're not satisfied with the answers you can always edit/clarify your question. –  Cristian Ciupitu Jan 9 '11 at 22:06
    
You can earn reputation by answering other people's questions. –  larsks Jan 9 '11 at 22:46

4 Answers 4

What you're realling asking is this. This is exactly what Gitorious does for git -- it runs via a command= entry in the ssh keys file and ensures that only git operations can be performed using the ssh key. The linked question asks about Gitorious-like software for Mercurial. Not being a Mercurial user I can't comment on the quality of the answers.

share|improve this answer
    
+1, Didn't realise hg has nice handy script to put in the command field. At least I was in the right ball park! –  Niall Donegan Jan 9 '11 at 22:58

You could modify the /etc/security/access.conf directive to allow only specific users to login, and no others.

The line would look something like this, but with your localized groups/users:

-:ALL EXCEPT your_group your_user1 your_user2 :ALL

Or if you have a specific group you want to blacklist specific users/groups:

-: blacklist_group1 blacklist_user :ALL

Or you could allow ssh access via group in the sshd.conf, but the access.conf method is a bit more global. This should allow your users to still access the host, but not login.

Eric

share|improve this answer

Mercurial comes with a script for exactly this! Use the contrib/hg-ssh script we provide to restrict the commands. The file contains this header to explain how to use it:

To be used in ~/.ssh/authorized_keys with the command option, see sshd(8):

command="hg-ssh path/to/repo1 /path/to/repo2 ~/repo3 ~user/repo4" ssh-dss ...

(probably together with these other useful options: no-port-forwarding, no-X11-forwarding, no-agent-forwarding)

This allows pull/push over SSH from/to the repositories given as arguments. If all your repositories are subdirectories of a common directory, you can allow shorter paths with:

command="cd path/to/my/repositories && hg-ssh repo1 subdir/repo2"

You can use pattern matching of your normal shell, e.g.:

command="cd repos && hg-ssh user/thomas/* projects/{mercurial,foo}" 
share|improve this answer

This should be possibly to do with ssh keys. Unfortunately, I have no idea exactly what you'd need to put after the key, you'd need to find out what hg push does when you do the push. For example, with rsync, you can do something like:

command="rsync --server -vlogDtpre.iL . /path/to/dir/",no-pty,no-agent-forwarding,no-port-forwarding ssh-dss Adslkjhdfslw.......rest_of_key

Put the above in .ssh/authorized_keys2 and then see if you can figure out what command hg push is running and put it in the command field.

It's possible that hg push is only doing an scp, in which case the scponly shell might also do the job.

Hopefully this will point you in the right direction.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.