I am trying to set up git-http-backend on my apache2 server. Right now it is working so far with suexec and a wrapper and all the stuff but without restrictions. I can pull and push.

Now I wanted to include the section to restrcit push permissions:

<LocationMatch "^/git/.*/git-receive-pack$">
    AuthType Basic
    AuthName "Git Access"
    AuthUserFile /var/www/vhosts/librepdm.alitecs.de/users
    Require user alexander

User file is in place and filled. This say my apache access_log: - - [28/Mar/2012:15:23:18 +0200] "GET /git/test.git/info/refs?service=git-receive-pack HTTP/1.1" 403 357 "-" "git/1.7.8.msysgit.0" - - [28/Mar/2012:15:23:18 +0200] "GET /git/test.git/info/refs HTTP/1.1" 200 331 "-" "git/1.7.8.msysgit.0" - - [28/Mar/2012:15:23:18 +0200] "GET /git/test.git/HEAD HTTP/1.1" 200 341 "-" "git/1.7.8.msysgit.0" - - [28/Mar/2012:15:23:22 +0200] "PROPFIND /git/test.git/ HTTP/1.1" 405 536 "-" "git/1.7.8.msysgit.0"

and this my error_log

[Wed Mar 28 15:23:18 2012] [error] [client] Service not enabled: 'receive-pack'

Ok, the hint is good, if I enable http.recievepack in the repo it works BUT if I don't tell the credentials in the url I get again an error AND I don't wan to activate that. So I tried something else. I edited the LocationMatch as follows:

<LocationMatch "^/git/.*$">
    AuthType Basic
    AuthName "Git Access"
    AuthUserFile /var/www/vhosts/librepdm.alitecs.de/users
    Require user alexander

I removed "git-recieve-pack" in the regex. And surprise everything is now protected also pulls BUT if I don't tell my credentials in the URL TortoiseGIT asks me for user and password AND push work without setting http.recievepack to true. The apache log is a little bit different: - - [28/Mar/2012:15:46:16 +0200] "GET /git/test.git/info/refs?service=git-receive-pack HTTP/1.1" 401 691 "-" "git/1.7.8.msysgit.0" - - [28/Mar/2012:15:46:20 +0200] "GET /git/test.git/info/refs?service=git-receive-pack HTTP/1.1" 401 691 "-" "git/1.7.8.msysgit.0" - alexander [28/Mar/2012:15:46:20 +0200] "GET /git/test.git/info/refs?service=git-receive-pack HTTP/1.1" 200 466 "-" "git/1.7.8.msysgit.0" - alexander [28/Mar/2012:15:46:21 +0200] "POST /git/test.git/git-receive-pack HTTP/1.1" 200 380 "-" "git/1.7.8.msysgit.0"

If I comapre that to the first one the first access call is different. In the first part it states 403 - unauthorized but i wasn't asked for credentails and it does not help to pass the in the url. I the second one it states 401 which is good.

So my question is why does the login work if I secure the whole location and not if I only want to secure pushing? The get commands are identical but somehow I am not asked for login. IMHO this is not a problem of git or TortoiseGT or mysysgit but of apache...

Regards, Alexander


I updated my configuration like this :

  <Location /public >

 SetEnv CGIT_CONFIG /srv/git/etc/cgitrc-public
 SetHandler cgi-script
 Options +ExecCGI

 RewriteCond %{QUERY_STRING} service=git-receive-pack
 RewriteRule .* - [E=AUTHREQUIRED:yes]

 AuthzLDAPAuthoritative Off
 AuthLDAPURL "ldap://myldap.mycorp.com/dc=mycorp,dc=com?mailNickname"
 AuthLDAPBindDN "ldapaccount"
 AuthLDAPBindPassword password
 AuthType Basic
 AuthName "MyCorp LDAP Protected Area"
 require valid-user


take a look at request


It didn't match anymore <LocationMatch "^/git/.*/git-receive-pack$"> because service=git-receive-pack is parameter and not location (URI)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.