Can you specify git-shell in .ssh/authorized_keys to restrict access to only git commands via ssh?

Question

I'd like to be able to use a ssh key for authentication, but still restrict the commands that can be executed over the ssh tunnel.

With Subversion, I've achieved this by using a .ssh/authorized_keys file like:

command="/usr/local/bin/svnserve -t --tunnel-user matt -r /path/to/repository",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAABIetc...

I've tried this with "/usr/bin/git-shell" in the command, but I just get the funky old fatal: What do you think I am? A shell? error message.

Answer 1

The following works for me.

In ~/.ssh/authorized_keys:

command="./gitserve",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty ssh-dss AAAAB…

In the ~/gitserve script:

#!/bin/sh
exec git-shell -c "$SSH_ORIGINAL_COMMAND"

Note that if you put gitserve somewhere other than the home directory, you will have to adjust the command="./gitserve" parameter in authorized_keys.

Answer 2

I could successfully use git-shell directly in the authorizedKeys file without using an additionnal script.

The key is to add \" around the env variable.

Tested in rhel6 openssh-server-5.3p1-70.el6.x86_64:

no-port-forwarding,no-agent-forwarding,command="git-shell -c \"$SSH_ORIGINAL_COMMAND\"" ssh-dss AAAA...

Answer 3

Grawity's solution can be easily modified to work by replacing the line

        exec $SSH_ORIGINAL_COMMAND

with the line

        git-shell -c "$SSH_ORIGINAL_COMMAND"

The quotes take care of the issues reported above, and replacing exec with git-shell seems a bit more secure.

Answer 4

git-shell is designed to be used as a login shell, so that it would receive -c "originalcommand" as arguments. This doesn't happen with "forced commands" in OpenSSH; instead, the forced command is passed to the configured shell.

What you can do is write a script that checks $SSH_ORIGINAL_COMMAND and executes it. Example in bash:

#!/bin/bash

SSH_ORIGINAL_COMMAND=${SSH_ORIGINAL_COMMAND/#git /git-}

case $SSH_ORIGINAL_COMMAND in
    "git-receive-pack"*|"git-upload-pack"*|"git-upload-archive"*)
        eval exec $SSH_ORIGINAL_COMMAND
        ;;
    *)
        echo "Go away." >&2
        exit 1
        ;;
esac

Answer 5

For completeness, and since the original question didn't specify that the same account had to be useable for non-git things, the obvious answer is to use git-shell as it was designed to be used: set it as the login shell (i.e. with usermod, in /etc/passwd) for that ssh user.

If you do have a single user account that you want to use two ways:

• when connecting with key authentication, use only for git
• when connecting with password authentication, or using a different private key, provide a full shell

...then the other answers in this thread apply. But if you can afford to allocate a separate user to git, then setting its shell to git-shell is the simplest way to restrict it, and is slightly more secure as it requires no additional shell scripts.

Answer 6

I couldn't get grawity's solution to work for the same reason that was reported by Neil Mayhew (ie. the single quotes sent by the git client causing an invalid $SSH_ORIGINAL_COMMAND -- I'm using git v1.7.x)

However, the following solution implemented by @moocode just works:

https://moocode.com/posts/6-code-your-own-multi-user-private-git-server-in-5-minutes

Ruby FTW! :-)