Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently I have purchased web hosting with ssh access.

I have created a git repository on it and if I set my public key in ~/.ssh/authorized_keys file, I have access to that repo, I can push/pull data, etc.

This solution allows access for every user that has his public key in authorized_keys file.

But there is one thing that I want to avoid. Every user can login to the server too and has access to whole ssh account.

Is it possible to create a blacklist of users' keys that will not have an access to ssh ?

I see it that way:

  • user logs in to a git - ok, allow for every one
  • user logs in to ssh account
  • ~/.profile file is hooked and called a custom script:
    • check user's public key
    • if public key is in ~/.ssh/blacklist_keys call bash exit/logout

Is it possible in any way ?

share|improve this question
add comment

2 Answers

Instead of just using plain git, you should look into using Gitolite. Gitolite is designed to do this kind of SSH based authentication without giving true SSH access to the machine. It also carries with it some extra goodies, such as strong ACLs and per-tag and per-branch permissions.

You could also use Gitosis which has much wider use, but the author recommends using Gitolite for additional functionality.

share|improve this answer
    
Is it possible to run it on my account without root privilages ? I have only a single user account associated with apache. –  hsz Mar 14 '11 at 15:54
    
You can run gitolite without root privileges, but there may be security issues associated with running the web daemon and the git daemon under the same user account. Not the end of the world though. –  Scrivener Mar 14 '11 at 16:11
    
Gitosis is unmaintained and deprecated, its not even worth mentioning it to people that don't already know about it anymore. –  Arrowmaster Mar 14 '11 at 17:17
add comment

You can disable shell login for particular user.

chsh -s /sbin/nologin {username}

Don't mess with profile files (.profile, .bash_profile, .bashrc etc). They are not for restricting login.

share|improve this answer
    
I have only my hsz user - on my account I can add ssh keys. I want to work with that single account. –  hsz Mar 14 '11 at 15:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.