Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to set up git-http-backend on my apache2 server. Right now it is working so far with suexec and a wrapper and all the stuff but without restrictions. I can pull and push.

Now I wanted to include the section to restrcit push permissions:

<LocationMatch "^/git/.*/git-receive-pack$">
    AuthType Basic
    AuthName "Git Access"
    AuthUserFile /var/www/vhosts/librepdm.alitecs.de/users
    Require user alexander
</LocationMatch>

User file is in place and filled. This say my apache access_log:

93.95.132.202 - - [28/Mar/2012:15:23:18 +0200] "GET /git/test.git/info/refs?service=git-receive-pack HTTP/1.1" 403 357 "-" "git/1.7.8.msysgit.0"
93.95.132.202 - - [28/Mar/2012:15:23:18 +0200] "GET /git/test.git/info/refs HTTP/1.1" 200 331 "-" "git/1.7.8.msysgit.0"
93.95.132.202 - - [28/Mar/2012:15:23:18 +0200] "GET /git/test.git/HEAD HTTP/1.1" 200 341 "-" "git/1.7.8.msysgit.0"
93.95.132.202 - - [28/Mar/2012:15:23:22 +0200] "PROPFIND /git/test.git/ HTTP/1.1" 405 536 "-" "git/1.7.8.msysgit.0"

and this my error_log

[Wed Mar 28 15:23:18 2012] [error] [client 93.95.132.202] Service not enabled: 'receive-pack'

Ok, the hint is good, if I enable http.recievepack in the repo it works BUT if I don't tell the credentials in the url I get again an error AND I don't wan to activate that. So I tried something else. I edited the LocationMatch as follows:

<LocationMatch "^/git/.*$">
    AuthType Basic
    AuthName "Git Access"
    AuthUserFile /var/www/vhosts/librepdm.alitecs.de/users
    Require user alexander
</LocationMatch>

I removed "git-recieve-pack" in the regex. And surprise everything is now protected also pulls BUT if I don't tell my credentials in the URL TortoiseGIT asks me for user and password AND push work without setting http.recievepack to true. The apache log is a little bit different:

93.95.132.202 - - [28/Mar/2012:15:46:16 +0200] "GET /git/test.git/info/refs?service=git-receive-pack HTTP/1.1" 401 691 "-" "git/1.7.8.msysgit.0"
93.95.132.202 - - [28/Mar/2012:15:46:20 +0200] "GET /git/test.git/info/refs?service=git-receive-pack HTTP/1.1" 401 691 "-" "git/1.7.8.msysgit.0"
93.95.132.202 - alexander [28/Mar/2012:15:46:20 +0200] "GET /git/test.git/info/refs?service=git-receive-pack HTTP/1.1" 200 466 "-" "git/1.7.8.msysgit.0"
93.95.132.202 - alexander [28/Mar/2012:15:46:21 +0200] "POST /git/test.git/git-receive-pack HTTP/1.1" 200 380 "-" "git/1.7.8.msysgit.0"

If I comapre that to the first one the first access call is different. In the first part it states 403 - unauthorized but i wasn't asked for credentails and it does not help to pass the in the url. I the second one it states 401 which is good.

So my question is why does the login work if I secure the whole location and not if I only want to secure pushing? The get commands are identical but somehow I am not asked for login. IMHO this is not a problem of git or TortoiseGT or mysysgit but of apache...

Regards, Alexander

share|improve this question
add comment

2 Answers

I updated my configuration like this :

  <Location /public >

 SetEnv CGIT_CONFIG /srv/git/etc/cgitrc-public
 SetHandler cgi-script
 Options +ExecCGI

 RewriteCond %{QUERY_STRING} service=git-receive-pack
 RewriteRule .* - [E=AUTHREQUIRED:yes]

 AuthzLDAPAuthoritative Off
 AuthLDAPURL "ldap://myldap.mycorp.com/dc=mycorp,dc=com?mailNickname"
 AuthLDAPBindDN "ldapaccount"
 AuthLDAPBindPassword password
 AuthType Basic
 AuthName "MyCorp LDAP Protected Area"
 require valid-user

share|improve this answer
add comment

take a look at request

/git/test.git/info/refs?service=git-receive-pack

It didn't match anymore <LocationMatch "^/git/.*/git-receive-pack$"> because service=git-receive-pack is parameter and not location (URI)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.