Would there be anyway to know the origin account's username that ssh'ed into the server?

Question

I initially git cloned a repo, when I push my work, within the post-receive hook, I would like to retrieve the origin acount's username who did the push.

I know $SSH_CONNECTION and $SSH_CLIENT give me the origin IP, but I can't find a way to get the username of the origin account.

Info: The ssh connection is established using the public key / passwordless method

chutz · Accepted Answer · 2012-12-22T18:31:56.797

2

I am assuming everyone is sharing the same user on the git server, and they each have their own key to log in with.

If that is the case, then instead of identifying the remote user, you could easily identify the public key that the user used to log into the git server. To do that, you should allow PermitUserEnvironment in your server's sshd_config, and then you can easily identify each public key by prefixing it with something like environment="GIT_USER=username". For example, the authorized_keys file for the git serve user could look like this:

environment="GIT_USER=bob" ssh-rsa AAA.....abc== bob@somehost
environment="GIT_USER=sam" ssh-rsa AAA.....def== sam@otherhost

You are free to choose the environment variable name and user identifier.

If you are using gitolite, then $GL_USER is what you are looking for.

If you are using gitosis, you should consider switching to gitolite.

edited Dec 22 '12 at 18:31

answered Dec 22 '12 at 18:21

chutz

7,569
1
28
57

Perfect. I wasn't able of that flexibility of the authorized_keys file. And I am using gitolite ;) Thanks for the hint on giolite! – Spredzy Dec 22 '12 at 18:35
I meant aware not able. – Spredzy Dec 22 '12 at 19:01
There is more you can do with the `authorized_keys`. I had hard time finding the info myself, but it is in `man sshd` - "AUTHORIZED_KEYS FILE FORMAT". – chutz Dec 23 '12 at 10:40

Dennis Kaarsemaker · Answer 2 · 2012-12-22T15:09:00.473

1

No, that information is not available in any way unless your git server can access the originating host as well (via ssh or something). In that case you can use netstat on both servers to match up ports, something like this in the hook:

shost=$(echo $SSH_CONNECTION | cut -f1 -d' ')
sport=$(echo $SSH_CONNECTION | cut -f2 -d' ')
remotepid=$(ssh specialcheckuser@remote sudo netstat -ptn | sed -ne 's/.*$shost:$sport.*ESTABLISHED \([0-9]\+\).*/\1/p')
remoteuser=$(ssh specliacheckuser@remote ps -o user --no-headers -$remotepid)

edited Dec 22 '12 at 15:09

answered Dec 22 '12 at 12:51

Dennis Kaarsemaker

18,793
2
43
69

My git server can access the host with ssh. Could you explain me what would be your solution using netstat ? – Spredzy Dec 22 '12 at 13:35
Amended the answer – Dennis Kaarsemaker Dec 22 '12 at 15:09
I understand your updated answer, but that would mean if I have a pool of X servers, I would need to run the `remotepid` and `remoteuser` commands on each of them until one match. Am I correct ? – Spredzy Dec 22 '12 at 15:20
No, only on `$shost`, the host where the ssh connection is originationg from. – Dennis Kaarsemaker Dec 22 '12 at 15:51
Then that would mean then that all my origin servers should have a 'specialcheckuser' account I can log in to check netstat values ? – Spredzy Dec 22 '12 at 15:57
Yeah. It's a PITA, so maybe you'll want to check out my other answer. – Dennis Kaarsemaker Dec 22 '12 at 16:50

score 1 · Answer 3 · answered Dec 22 '12 at 15:12

1

Another possibility, if you control both hosts: good old identd. You can query identd on the originating host to see who set up the connection. This of course only works if you have full control over that host, or else you might get bogus data.

answered Dec 22 '12 at 15:12

Dennis Kaarsemaker

18,793
2
43
69

1

In fact the reason it is now disabled on nearly all of the standard install distributions is the fact that it was hardly reliable these days. – mdpc Dec 22 '12 at 16:45

Would there be anyway to know the origin account's username that ssh'ed into the server?

3 Answers3