Consider a server that hosts several Git repositories:

$ ls -l /opt/git/
drwxrwxr-x 7 ubuntu root   4096 Jan  2  2014 george.git
drwxrwxr-x 7 ubuntu root   4096 Dec 29  2013 john.git
drwxrwsr-x 7 ubuntu root   4096 Jul  4  2013 paul.git
drwxrwsr-x 7 ubuntu root   4096 Jun 30  2013 ringo.git

Until now, all developers had access to all the Git repos via SSH. I am now adding a dev who should only have access to the john.git repo. I've created a Linux user yoko but I'm not sure how I should let yoko access the /opt/git/john.git directory in the safest manner without letting him access the other directories in /opt/git/.

What is the canonical way of restricting access as such?

My inclination is to make the john.git as group foobar and add that group to user yoko's groups. However, what happens if I later need to add another user that could access two repos? For instance, I might want to add user cynthia with access to both john.git and to paul.git. Should I have a separate group for each Git repo? I could see that getting unwieldy very quickly

Note that these users should have access to nothing other than their own /home/user/ directories and additionally to the Git repo(s) that they are permitted. If there is a way to symlink i.e. /home/yoko/john.git to /opt/git/john.git in a way that prevents access to the rest of /opt/git/ that would be best, however I cannot seem to configure the system as such.

The server is running Ubuntu Server 12.04 but I could possibly update it to 14.04 if there is need. The users connect via SSH using RSA keys, no password. They will be performing git pull and git push on the server, nothing more.

  • 1
    You should look at gitolite or gitlab – Alexey Ten Aug 7 '14 at 19:24

For a small number of repos, the groups approach works just fine. Yes, each repo potentially needs its own group, and it does get unwieldy if you've got more repos. As @AlexeyTen mentioned in the comments, if you have a larger number of repos, or would like a more "high-level" management interface, you should look at a repo manager like gitolite or gitlab. Gitolite is managed via text files in a git repo (config files and SSH keys are committed to a special git repo and pushed, and everything is configured). Gitlab, on the other hand, is an all-in-one webapp similar in concept to a self-hosted Github. If you don't need all the bells and whistles, gitolite will almost certainly do the job perfectly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.