I've set up a Mercurial server on a Linux machine and it works fine. Users can, for example, push and pull to it using something like:

hg push ssh://...

Users can also ssh into the server.

For some users I'd like to restrict the access to they can only access Mercurial.

How would I go about this?

  • If you're not satisfied with the answers you can always edit/clarify your question. Jan 9, 2011 at 22:06
  • You can earn reputation by answering other people's questions.
    – larsks
    Jan 9, 2011 at 22:46

4 Answers 4


What you're realling asking is this. This is exactly what Gitorious does for git -- it runs via a command= entry in the ssh keys file and ensures that only git operations can be performed using the ssh key. The linked question asks about Gitorious-like software for Mercurial. Not being a Mercurial user I can't comment on the quality of the answers.

  • +1, Didn't realise hg has nice handy script to put in the command field. At least I was in the right ball park! Jan 9, 2011 at 22:58

Mercurial comes with a script for exactly this! Use the contrib/hg-ssh script we provide to restrict the commands. The file contains this header to explain how to use it:

To be used in ~/.ssh/authorized_keys with the command option, see sshd(8):

command="hg-ssh path/to/repo1 /path/to/repo2 ~/repo3 ~user/repo4" ssh-dss ...

(probably together with these other useful options: no-port-forwarding, no-X11-forwarding, no-agent-forwarding)

This allows pull/push over SSH from/to the repositories given as arguments. If all your repositories are subdirectories of a common directory, you can allow shorter paths with:

command="cd path/to/my/repositories && hg-ssh repo1 subdir/repo2"

You can use pattern matching of your normal shell, e.g.:

command="cd repos && hg-ssh user/thomas/* projects/{mercurial,foo}" 

You could modify the /etc/security/access.conf directive to allow only specific users to login, and no others.

The line would look something like this, but with your localized groups/users:

-:ALL EXCEPT your_group your_user1 your_user2 :ALL

Or if you have a specific group you want to blacklist specific users/groups:

-: blacklist_group1 blacklist_user :ALL

Or you could allow ssh access via group in the sshd.conf, but the access.conf method is a bit more global. This should allow your users to still access the host, but not login.



This should be possibly to do with ssh keys. Unfortunately, I have no idea exactly what you'd need to put after the key, you'd need to find out what hg push does when you do the push. For example, with rsync, you can do something like:

command="rsync --server -vlogDtpre.iL . /path/to/dir/",no-pty,no-agent-forwarding,no-port-forwarding ssh-dss Adslkjhdfslw.......rest_of_key

Put the above in .ssh/authorized_keys2 and then see if you can figure out what command hg push is running and put it in the command field.

It's possible that hg push is only doing an scp, in which case the scponly shell might also do the job.

Hopefully this will point you in the right direction.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .