Consider a server that hosts several Git repositories:
$ ls -l /opt/git/ drwxrwxr-x 7 ubuntu root 4096 Jan 2 2014 george.git drwxrwxr-x 7 ubuntu root 4096 Dec 29 2013 john.git drwxrwsr-x 7 ubuntu root 4096 Jul 4 2013 paul.git drwxrwsr-x 7 ubuntu root 4096 Jun 30 2013 ringo.git
Until now, all developers had access to all the Git repos via SSH. I am now adding a dev who should only have access to the
john.git repo. I've created a Linux user
yoko but I'm not sure how I should let
yoko access the
/opt/git/john.git directory in the safest manner without letting him access the other directories in
What is the canonical way of restricting access as such?
My inclination is to make the
john.git as group
foobar and add that group to user
yoko's groups. However, what happens if I later need to add another user that could access two repos? For instance, I might want to add user
cynthia with access to both
john.git and to
paul.git. Should I have a separate group for each Git repo? I could see that getting unwieldy very quickly
Note that these users should have access to nothing other than their own
/home/user/ directories and additionally to the Git repo(s) that they are permitted. If there is a way to symlink i.e.
/opt/git/john.git in a way that prevents access to the rest of
/opt/git/ that would be best, however I cannot seem to configure the system as such.
The server is running Ubuntu Server 12.04 but I could possibly update it to 14.04 if there is need. The users connect via SSH using RSA keys, no password. They will be performing
git pull and
git push on the server, nothing more.