hedge
hedge is git access control for ssh. It runs as the forced command of an ssh key and lets that key's identity fetch from or push to the repositories an access list grants it, and nothing else.
Requirements
- git-shell, which comes with git
Installation
cd hedge
make clean install
Usage
List the grants in the acl file, one per line:
greenhouse write lostduk
greenhouse read alice
Each line is repo read|write id, fields separated by a single space,
repo written without .git. There are no comments or wildcards. Write
access implies read access.
Give each ssh key of the git user its identity in authorized_keys:
command="/usr/local/bin/hedge lostduk",restrict ssh-ed25519 AAAA...
and clone with git clone git@host:greenhouse.
How it works
hedge reads the git command from SSH_ORIGINAL_COMMAND, checks it and
hands it to git-shell as verb 'root/repo.git'. git-upload-pack and
git-upload-archive need read access, git-receive-pack needs write
access. Any other command, including an interactive login, is refused.
The repository path may be quoted, may start with a slash and may end with
a slash or .git. What remains must be /-separated segments matching
^[A-Za-z0-9_][A-Za-z0-9._-]*$, so nested repositories such as
group/repo work.
hedge exits with 1 when access is denied or git-shell can't be run, and with git-shell's status otherwise.
Configuration
| setting | default | meaning |
|---|---|---|
root |
/srv/git |
directory of bare repositories |
acl |
/etc/hedge/acl |
the access list |
gitshell |
git-shell |
command access is handed to |
See also
- petal, to browse the same repositories
- hedge(1), git-shell(1), sshd(8)