Hey Fediverse: do you know of a smaller alternative to #Gitolite?
I want to restrict specific SSH users to specific Git repositories. So ideally I just want to add some "restricted shell" to the lines in authorized_keys and that's it. Basically like git-shell, but with a directory limit. Or like Gitolite, but much smaller. Ideas?
(I could also create a different system user for each repository, but that's quite some management overhead as well.)
Hm, so it looks like this can be done with #Jailkit, by adding something like this to the authorized_key file:
command="/usr/bin/jk_uchroot -j /srv/git/ -x /usr/bin/gitshellwrapper" ...
where /usr/bin/gitshellwrapper contains:
#!/bin/sh
exec git-shell -c "$SSH_ORIGINAL_COMMAND"
But I'm not yet convinced that this is really watertight; so I guess I'll just go with separate user accounts for now. Jailkit is still useful (with the ChrootDirectory option in sshd_config).
ollibaba