Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

is that even possible?

Summary, i'm running puppet master on a server and ideally we want root logins via ssh disabled, we want to force all access via sudo if root access required

however we have puppet installed using a git repo to manage the manifests, this repo is currently owned by root and currently i only know of 2 solutions

  1. (less ideal) allow root access via key auth only - if so, what can i lock it down to to only allow the git push commands?
  2. own the repo in /etc/puppet as a different owner - will puppet work reliably with this?
share|improve this question

3 Answers 3

Git repos can be configured to maintain group write permissions (option --shared when creating the repository). Using that, then you can add any accounts that need access to the repository to a particular group, so that they can access it.

I do that for our git server. I also put a symlink in each user's home directory to each repository they have access too, so everyone can access with a relative URL.

share|improve this answer
    
so if understand this correctly when i clone or init the git repo on the server i add the --shared tag, make sure the directory is owned by a group (say puppet) and then add users pushing to it to the puppet group? –  anthonysomerset Nov 17 '11 at 17:45
    
@anthonysomerset Pretty much. You have to make sure to do sg to the group you want to be the owner before creating the repository, so that git will know what use you want. –  Daniel C. Sobral Nov 17 '11 at 23:07
up vote 0 down vote accepted

To answer my own question, i looked at the info Daniel Provided but it didnt tally up, i researched git group write and came accross http://andyregan.net/blog/archives/504

by giving my repository group ownership by a common group (puppet) and adding the relevant users to that group, and then running:

chmod -R g+swX /etc/puppet/
cd /etc/puppet
git repo-config core.sharedRepository true

worked perfectly for me, i can push to a root owned repository, puppet still works and i dont use a root ssh login to do so

Win, Win

share|improve this answer

What I like to do is have a "staging" bare git repo on the puppet master that I push to that runs various pre-commit and post-commit hooks. Pre-commit hooks check puppet syntax (so that code with bad syntax can't be committed) and post-commit hooks actually drop the code into /etc/puppet, and restart Apache (to fix an old cacheing bug in puppet 2.6)

Having a staging area that you push to makes the process of deploying puppet code more atomic. Otherwise, it may be possible for you puppetmaster to be serving half-commited code to clients.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.