Question

I have a centos server with code maintained using a mercurial repo.
To allow a new person to commit code to mercurial, I create a new user, add them to the webdev group, and they can push / pull code by

hg pull ssh://[e-mail]. 

However, there are some files (config files) that I would not like new users to have access to. Mercurial has been asked not to track these files, so the only way to access them is to ssh into the system and look at the files. Which I dont want new users to be able to do.

In essence, I want my new developers to only pull/push files through hg and disallow ssh-ing directly into the system. What the best way to do this? Can I provide hg access to a repo without providing ssh access to the files?

(or is my approach to the problem flawed?)

Thanks!

Answer 1

This can be really easily done by taking advantage of the command option available in .ssh\authorized_keys files. When you’re granting their key access in that file you can prepend a “command=….” argument to their key and that’s the only command they can run.

Mercurial ships with a handy script for doing exactly that. It has instructions inside:

https://www.mercurial-scm.org/repo/hg/file/tip/contrib/hg-ssh