3

I've got a user that I'd like to only be able to use subversion. We like to use svn+ssh:// URLs sometimes (for public keys and whatnot), so I need them to be able to connect over ssh and run only the svnserve command.

When using a svn+ssh URL, svn ssh'es in and passes the arguments "-c svnserve -t". I wrote a custom shell as follows to filter the commands that can be run. This works, but it's not passing the input to svnserve, so when I try to "svn up" I get "svn: Connection closed unexpectedly".

#!/bin/bash
if [ "$1" == "-c" ] && [ "$2" == "svnserve" ] && [ "$3" == "-t" ] && [ "$4" == ""] ; then
        exec svnserve -t
else
        echo "Access denied. User may only run svnserve."
fi
1
  • You should be aware that your test allows calls such as -c svnserve -t "" somethingmore. Instead of checking for $4 to be null, you should check for the arg count. if [ "$1" == "-c" ] && [ "$2" == "svnserve" ] && [ "$3" == "-t" ] && [ $# = 3 ] Mar 17, 2010 at 22:24

2 Answers 2

4

I am pretty sure you could put something like this at the end of your sshd_config.

Match User svnuser
  ForceCommand svnserve -t
0
1

In the file authorized_keys add the line command="svnserve" and whatnot at the beginning of his key. In this way when he connect with ssh it will run that command then exit, e.g.

command="svnserve" ssh-rsa AAA...LONG AND TEDIOUS KEY...== user@localhost

check man sshd and the subversion documentation for details

1
  • We're not necessarily using public key auth, but thanks for the suggestion.
    – sbleon
    Mar 19, 2010 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.