Securing git server

Question

I setup a git server over ssh as

http://blog.commonthread.com/post/1034988660/setting-up-a-git-server

However, I am still able to access the server by ssh and see all the folders on the server. How do you usually secure the server so that the git user cannot get out of the home directory and possibly do damage? I read some things about chroot or jail. Or setting the permissions of the home directory to 700. I would like to know the easiest way to achieve some security and the details on how to do it. This is on a Centos Linux server.

Is there a way to deny command line access while still allowing the user to push/pull from git?

Brinn

You usually set the user's shell to a magic git push/pull only shell that's supplied by git. But I can't remember the name. – Mistreat

For the future visitors who might read this question, there is an official tutorial on the git homepage for exactly this thing: git-scm.com/book/en/Git-on-the-Server-Setting-Up-the-Server – Rompers

Answer 1

You should set the user's shell to git-shell. From the docs (indeed, almost the entire man page):

This is meant to be used as a login shell for SSH accounts you want to restrict to GIT pull/push access only. It permits execution only of server-side GIT commands implementing the pull/push functionality. The commands can be executed only by the -c option; the shell is not interactive.

(Rup, in the comments, if you'd just googled git shell...)

Garvey

Great answer! I used this link kernel.org/pub/software/scm/git/docs/everyday.html Then I tried using ssh to get in and I get this message: fatal: What do you think I am? A shell? Very cool – Brinn

Answer 2

An alternative would be to use gitolite or gitosis, both of which manage this for you and are pretty easy to configure.

Compeer

I was looking into gitosis as well. It might be good for more fine grained control. Thanks for your answer! – Brinn