URL: https://linuxfr.org/users/arodier/journaux/serveur-git-perso-via-ssh Title: Serveur Git perso via SSH Authors: Andre Rodier Date: 2024年05月06日T21:25:31+02:00 License: CC By-SA Tags: git, ssh et shell Score: 30 Petit journal pour faire un serveur Git perso, SSH uniquement, pas d'accès web. Pas de fioritures, mais le minimum doit fonctionner : - Création de dépôt automatique. - Restriction d'accès, seul un accès avec Git autorisé. Sans doute plus utile pour un backup de projets personnels que pour une collaboration à grande échelle, mais ce n'était pas le but. Je passe la configuration du serveur SSH, qui doit est spécifique à chaque utilisateur, mais on peut également limiter l'accès au niveau du serveur SSH : ``` Match Group users AllowTcpForwarding no AllowStreamLocalForwarding no AllowAgentForwarding no PermitTunnel no PermitTTY no PermitUserRC no ForceCommand /usr/local/bin/git-only ``` ## Script d'encapsulation Git ```bash #!/bin/sh -e # ## --- ## This script allow git access to user repositories. ## Git repositories are automatically created on first push. ## Valid repository names should start with a letter, followed ## by alphanumeric or hyphen, underscore and dot characters ## Repositories are stored in /home by default. ## Example of repository creation: ## $ git remote add personal user@domain:repo-name.git ## $ git push --all --tags personal ## --- # # Error codes SUCCESS=0 NO_CMD=10 NO_PATH=20 NO_ROOT=30 INVALID_NAME=40 SYS_ERROR=50 usage() { sed -n 's/^## //p' "0ドル" 1>&2 } if [ "1ドル" = "-h" ] || [ "1ドル" = "--help" ]; then usage exit fi if [ -n "$SSH_CONNECTION" ] && [ -z "$SSH_ORIGINAL_COMMAND" ]; then echo "Your key can only be used for git" 1>&2 usage exit $NO_CMD fi # Get the user running the script calling_user=$(whoami) # This shouldn't be run by root if [ "$calling_user" = "root" ]; then echo "This script should not be run by root" 1>&2 usage exit $NO_ROOT fi # Log the command run logger "Running $SSH_ORIGINAL_COMMAND for user '$calling_user' (from $SSH_CLIENT)" # Do not create world readable files and directories umask 077 # Set the git root directory git_root_dir="/home/$calling_user/git/" git_repo_dir="$git_root_dir/repositories" if [ ! -d "$git_repo_dir" ]; then mkdir -p "$git_repo_dir" fi # Everything should run in this directory cd "$git_repo_dir" || exit $SYS_ERROR # This block automatically creates the git directory the first time we push is_push=$(echo "$SSH_ORIGINAL_COMMAND" | grep -E -c '^git-receive-pack.*') if [ "$is_push" = "1" ]; then # Check if the folder exists repo_path=$(echo "$SSH_ORIGINAL_COMMAND" | head -n 1 | cut -f 2 -d ' ' | tr -d "'") # Make sure we don't pass the home directory if expr match "$repo_path" ".*~.*">/dev/null; then echo "Do not specify the user path for your git repository" 1>&2 usage exit $NO_PATH fi if expr match "$repo_path" ".*/.*">/dev/null; then echo "Do not specify any absolute path for your git repository" 1>&2 usage exit $NO_PATH fi # Cleanup the repository name repo_name=$(echo "$repo_path" | sed -E "s:[^a-zA-Z]*([a-zA-Z][a-zA-Z0-9_\.-]+).*:1円:") # Make sure the repository name was clean if [ "$repo_path" != "$repo_name" ]; then echo "The name $repo_path is not valid, use '$repo_name' instead." 1>&2 echo "Valid repository name should start by a letter, then alphanumeric or (-) (_) and (.)" 1>&2 usage exit $INVALID_NAME fi if [ ! -d "$repo_name" ]; then logger "Creating new repository '$repo_name'" git init --bare "$repo_name">/dev/null 2>&1 fi fi exec git-shell -c "$SSH_ORIGINAL_COMMAND" ``` ## Exemple de configuration des clés autorisées Dans le fichier `~/.ssh/authorized_keys`: ``` command="/usr/local/bin/git-only" ssh-ed25519 AAAAC3NzaCKlZDIOpOTE5AAAAIBY4lPxia6FXSSI/KCu453tWdX8ERWwyl/CHfPVxDYu git-only-2024 ```