Question

I’m part of a small team trying to start coding on a project. I’ve decided it’s time to give git a chance (no more svn) and was trying to see if we could use our shared web hosting to deploy a “public” repository there so that we can easily push/pull to/from it and keep up-to-date with each others changes.

The problem I’m having now is that we only have a single ssh account for that hosting. Having used svn in the past, I could enforce a svn username on a given pair of ssh keys, however I don’t seem to be able to do something similar with git (in other words tie the ssh keypair to a specific dev). I don’t mind everybody having read/write permissions everywhere, since anything that is private should stay on each others machine. Finally, solutions such as gitosis can not be used.

I guess my question to you is how is accountability to git pushes given? Is it tied to the ssh account being used, or the email address given in git config? Can I create different ssh keys for every developer (for the same ssh account though), and just send them to the devs?

Answer 1

Just as an update, I ended up doing the above with a custom gitserve script I found somewhere round (sorry don’t have the link anymore):

#!/usr/bin/env ruby

# user and permissions are passed from authorized_keys

user = ARGV[0]
permissions = ARGV[1]
command = ENV['SSH_ORIGINAL_COMMAND']
abort unless user and permissions and command

# check the supplied command contains a valid git action 

valid_actions = ['git-receive-pack', 'git-upload-pack']
action = command.split[0]
abort unless valid_actions.include? action

# check the permissions for this user

abort "read denied for #{user}" unless permissions =~ /r/
abort "write denied for #{user}" if action == 'git-receive-pack' and permissions !~ /w/

STDERR.write "user #{user} authorized\n"

# user made a valid request so handing over to git-shell

Kernel.exec 'git', 'shell', '-c', command

My .authorized_keys file contains then entries starting like that:

command="/path/to/custom/script <username> <permissions>",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa ...

where permissions = r, w or rw. Thanks all for your comments!