2

Currently I have purchased web hosting with ssh access.

I have created a git repository on it and if I set my public key in ~/.ssh/authorized_keys file, I have access to that repo, I can push/pull data, etc.

This solution allows access for every user that has his public key in authorized_keys file.

But there is one thing that I want to avoid. Every user can login to the server too and has access to whole ssh account.

Is it possible to create a blacklist of users' keys that will not have an access to ssh ?

I see it that way:

  • user logs in to a git - ok, allow for every one
  • user logs in to ssh account
  • ~/.profile file is hooked and called a custom script:
    • check user's public key
    • if public key is in ~/.ssh/blacklist_keys call bash exit/logout

Is it possible in any way ?

2

Instead of just using plain git, you should look into using Gitolite. Gitolite is designed to do this kind of SSH based authentication without giving true SSH access to the machine. It also carries with it some extra goodies, such as strong ACLs and per-tag and per-branch permissions.

You could also use Gitosis which has much wider use, but the author recommends using Gitolite for additional functionality.

3
  • Is it possible to run it on my account without root privilages ? I have only a single user account associated with apache.
    – hsz
    Mar 14 '11 at 15:54
  • You can run gitolite without root privileges, but there may be security issues associated with running the web daemon and the git daemon under the same user account. Not the end of the world though.
    – Scrivener
    Mar 14 '11 at 16:11
  • Gitosis is unmaintained and deprecated, its not even worth mentioning it to people that don't already know about it anymore. Mar 14 '11 at 17:17
0

You can disable shell login for particular user.

chsh -s /sbin/nologin {username}

Don't mess with profile files (.profile, .bash_profile, .bashrc etc). They are not for restricting login.

1
  • I have only my hsz user - on my account I can add ssh keys. I want to work with that single account.
    – hsz
    Mar 14 '11 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.