From cdd9b3c96cc4a01bbc5f2f778e75028ea67a5f91 Mon Sep 17 00:00:00 2001 From: Jonathan Nieder Date: Sat, 9 Mar 2013 13:55:37 -0800 Subject: [PATCH 1/2] shell doc: emphasize purpose and security model The original git-shell(1) manpage emphasized that the shell supports only git transport commands. As the shell gained features, that emphasis and focus in the manual has been lost. Bring it back by splitting the manpage into a few short sections and fleshing out each: - SYNOPSIS, describing how the shell gets used in practice - DESCRIPTION, which gives an overview of the purpose and guarantees provided by this restricted shell - COMMANDS, listing supported commands and restrictions on the arguments they accept - INTERACTIVE USE, describing the interactive mode Also add a "see also" section with related reading. Signed-off-by: Jonathan Nieder Signed-off-by: Junio C Hamano --- Documentation/git-shell.txt | 62 +++++++++++++++++++++++++++++-------- 1 file changed, 49 insertions(+), 13 deletions(-) diff --git a/Documentation/git-shell.txt b/Documentation/git-shell.txt index 9b9250600f..544b21aaa6 100644 --- a/Documentation/git-shell.txt +++ b/Documentation/git-shell.txt @@ -9,25 +9,61 @@ git-shell - Restricted login shell for Git-only SSH access SYNOPSIS -------- [verse] -'git shell' [-c ] +'chsh' -s $(command -v git-shell) +'git clone' `@localhost:/path/to/repo.git` +'ssh' `@localhost` DESCRIPTION ----------- -A login shell for SSH accounts to provide restricted Git access. When -'-c' is given, the program executes non-interactively; - can be one of 'git receive-pack', 'git upload-pack', 'git -upload-archive', 'cvs server', or a command in COMMAND_DIR. The shell -is started in interactive mode when no arguments are given; in this -case, COMMAND_DIR must exist, and any of the executables in it can be -invoked. +This is a login shell for SSH accounts to provide restricted Git access. +It permits execution only of server-side Git commands implementing the +pull/push functionality, plus custom commands present in a subdirectory +named `git-shell-commands` in the user's home directory. -'cvs server' is a special command which executes git-cvsserver. +COMMANDS +-------- -COMMAND_DIR is the path "$HOME/git-shell-commands". The user must have -read and execute permissions to the directory in order to execute the -programs in it. The programs are executed with a cwd of $HOME, and - is parsed as a command-line string. +'git shell' accepts the following commands after the '-c' option: + +'git receive-pack ':: +'git upload-pack ':: +'git upload-archive ':: + Call the corresponding server-side command to support + the client's 'git push', 'git fetch', or 'git archive --remote' + request. +'cvs server':: + Imitate a CVS server. See linkgit:git-cvsserver[1]. + +If a `~/git-shell-commands` directory is present, 'git shell' will +also handle other, custom commands by running +"`git-shell-commands/ `" from the user's home +directory. + +INTERACTIVE USE +--------------- + +By default, the commands above can be executed only with the '-c' +option; the shell is not interactive. + +If a `~/git-shell-commands` directory is present, 'git shell' +can also be run interactively (with no arguments). If a `help` +command is present in the `git-shell-commands` directory, it is +run to provide the user with an overview of allowed actions. Then a +"git> " prompt is presented at which one can enter any of the +commands from the `git-shell-commands` directory, or `exit` to close +the connection. + +Generally this mode is used as an administrative interface to allow +users to list repositories they have access to, create, delete, or +rename repositories, or change repository descriptions and +permissions. + +SEE ALSO +-------- +ssh(1), +linkgit:git-daemon[1], +contrib/git-shell-commands/README GIT --- From 35297089e550c30e6d0f6db2adca5d44d254a7ed Mon Sep 17 00:00:00 2001 From: Jonathan Nieder Date: Sat, 9 Mar 2013 14:00:11 -0800 Subject: [PATCH 2/2] shell: new no-interactive-login command to print a custom message If I disable git-shell's interactive mode by removing the ~/git-shell-commands directory, attempts to ssh in to the service produce a message intended for the administrator: $ ssh git@myserver fatal: Interactive git shell is not enabled. hint: ~/git-shell-commands should exist and have read and execute access. $ That is helpful for the new admin who is wondering "What? Why isn't the git-shell I just set up working?", but once the site setup is complete, it would be better to give the user a friendly hint that she is on the right track, like GitHub does. Hi ! You've successfully authenticated, but GitHub does not provide shell access. An appropriate greeting might even include more complex dynamic information, like gitolite's list of repositories the user has access to. Add support for a ~/git-shell-commands/no-interactive-login command that generates an arbitrary greeting. When the user tries to log in: * If the file ~/git-shell-commands/no-interactive-login exists, run no-interactive-login to let the server say what it likes, then hang up. * Otherwise, if ~/git-shell-commands/ is present, start an interactive read-eval-print loop. * Otherwise, print the usual configuration hint and hang up. Reported-by: Ethan Reesor Signed-off-by: Jonathan Nieder Improved-by: Jeff King Signed-off-by: Junio C Hamano --- Documentation/git-shell.txt | 20 ++++++++++++++++++++ shell.c | 13 +++++++++++++ 2 files changed, 33 insertions(+) diff --git a/Documentation/git-shell.txt b/Documentation/git-shell.txt index 544b21aaa6..c35051ba58 100644 --- a/Documentation/git-shell.txt +++ b/Documentation/git-shell.txt @@ -59,6 +59,26 @@ users to list repositories they have access to, create, delete, or rename repositories, or change repository descriptions and permissions. +If a `no-interactive-login` command exists, then it is run and the +interactive shell is aborted. + +EXAMPLE +------- + +To disable interactive logins, displaying a greeting instead: ++ +---------------- +$ chsh -s /usr/bin/git-shell +$ mkdir $HOME/git-shell-commands +$ cat >$HOME/git-shell-commands/no-interactive-login <<\EOF +#!/bin/sh +printf '%s\n' "Hi $USER! You've successfully authenticated, but I do not" +printf '%s\n' "provide interactive shell access." +exit 128 +EOF +$ chmod +x $HOME/git-shell-commands/no-interactive-login +---------------- + SEE ALSO -------- ssh(1), diff --git a/shell.c b/shell.c index 84b237fef3..1429870a8f 100644 --- a/shell.c +++ b/shell.c @@ -6,6 +6,7 @@ #define COMMAND_DIR "git-shell-commands" #define HELP_COMMAND COMMAND_DIR "/help" +#define NOLOGIN_COMMAND COMMAND_DIR "/no-interactive-login" static int do_generic_cmd(const char *me, char *arg) { @@ -65,6 +66,18 @@ static void run_shell(void) { int done = 0; static const char *help_argv[] = { HELP_COMMAND, NULL }; + + if (!access(NOLOGIN_COMMAND, F_OK)) { + /* Interactive login disabled. */ + const char *argv[] = { NOLOGIN_COMMAND, NULL }; + int status; + + status = run_command_v_opt(argv, 0); + if (status < 0) + exit(127); + exit(status); + } + /* Print help if enabled */ run_command_v_opt(help_argv, RUN_SILENT_EXEC_FAILURE);