Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up a secure git repository server using ssh-keys and git-shell. Since our user database is stored in a central LDAP directory, I can't change users' default shell to git-shell, so I've tried prepending the git-shell command to the public key in the authorized_users file like this:

command="git-shell -c $SSH_ORIGINAL_COMMAND" ssh-dss AAAAB3NzaC1kc3...

However, git-shell won't even allow me to clone the repository:

    dhcp202:git-ws frank$ git clone ssh://gitserver/var/repos/git/myrepo/
    Cloning into myrepo...
    fatal: What do you think I am? A shell?
    fatal: The remote end hung up unexpectedly

Any ideas appreciated...

share|improve this question
up vote 1 down vote accepted

You will find a similar mechanism with gitolite, based on ssh and forced command.
(including ldap queries).
It don't allow interactive shell however, which could be your issue there.

The OP Frank Brenner adds:

Ah, I figured it out - the command has to be in single quotes. I suppose $SSH_ORIGINAL_COMMAND was getting expanded before git-shell was started.

That is confirmed in the gitolite forced command script is a Perl one, ending with:

# ----------------------------------------------------------------------------
#       over to git now
# ----------------------------------------------------------------------------

    # the GIT_HTTP_BACKEND env var should be set either by the rc file, or as
    # a SetEnv in the apache config somewhere


$repo = "'$REPO_BASE/$repo.git'";
exec("git", "shell", "-c", "$verb $repo") unless $verb eq 'git-init';

Note the $repo = "'$REPO_BASE/$repo.git'" line: it does contains single quotes.

share|improve this answer
Thanks for the info, but shouldn't git-shell as forced-command allow a "clone" operation? – Frank Brenner Mar 23 '11 at 14:15
@FRank: yes, but I suppose there is an issue in the way you are calling git-shell (btw, did you try "git shell" instead of "git-shell"?) – VonC Mar 23 '11 at 14:19
Yes I did try "git shell ...", to no avail, though. – Frank Brenner Mar 23 '11 at 15:17
Ah, I figured it out - the command has to be in single quotes. I suppose $SSH_ORIGINAL_COMMAND was getting expanded before git-shell was started... – Frank Brenner Mar 23 '11 at 15:58
@Frank: excellent. I have included your solution in my answer, pointing out the single quotes in the gitolite forced-command script as well. – VonC Mar 23 '11 at 16:11

I've made a solution using LDAP, OpenSSH (>4.9) and git-shell.

OpenSSH's ForceCommand is perfect for the job. Consider the following configuration (everyone except admins have to use git-shell):

Match group *,!admin    
    ForceCommand /usr/bin/git-shell -c "$SSH_ORIGINAL_COMMAND"

Access control is defined using ACL-s and reponame access groups.

setfacl -bR -m default:group:$REPONAME:rwX -m group:$REPONAME:rwX $GITROOT/$REPONAME
setfacl -R -m default:group:$REPONAME-ro:r-X -m group:$REPONAME-ro:r-X $GITROOT/$REPONAME

Don't forget to run "nscd -i group", after each change.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.