2

I'm not sure if I'm allowed to post and have one of my newly asked question on both security.stackexchange and unix.stackexchange or not, but I think it is appropriate to ask the question here too since it's about security of using git server and configuring it in a secure way and not only about the typical configuration. So here is what I've faced with several problems during the configuration, and I'd be so grateful if anyone can help.

I'm setting up a git server, and there will be three different groups working on different projects iOS, WebDevel, Android. I need to do it in a secure/safe way.

Meanwhile, I don't want iOS developers to be able to change Android stuff, or vice versa. In other words, I want to restrict any group only to their own project. (Read permission is not an issue, but if you can tell me how I can restrict read permission too, I'll be thankful)

I need your help in configuring the server in a way that Developers can use pull/push/commit through SSH via their public key, but ONLY for their own project! Is there a way to jail them to their own project repo directory? For instance, is there a way to say whenever X user with the public key of x_id_rsa.pub or with the request of git@mygitserver.com:~/git/iOS trying to push or pull data, should be jailed to iOS and shouldn't be allowed to add any commit or anything else to other projects?

And the final question is that how can I use different types of policies for each repo directory by SELinux, and how much helpful can it be?

I'm using CentOS 7, please explain in details. I'm open to any suggestion, Thanks in advance.

  • 1
    I'm not sure I understand the problem. You are not obliged to merge every single PR from the developers into the main branch. And what's wrong with getting a suggestion for a fix? – techraf Sep 7 '16 at 7:14
  • @techraf Everything works fine, they can use clone, pull, push etc., but I cannot restrict connections and set different keys for a each project. I tried to use different .ssh/id_rsa.pubs for each project, but it won't work since it's looking for the pubkey in user git's home directory. All I need, is to restrict connections, iOS developers shouldn't be able to clone Android repo, and vice versa. But on my current state, everyone is holding a key and has the possibility to use any internal project and repo created by user git. – Parsa Samet Sep 7 '16 at 19:47
  • Source code repository services are pretty much a commodity item these days and available at vary low costs. If you don't have an experienced git (or whatever) administration resources, why not just use something like github, bitbucket or whatever and avoid the administrative overheads? – Tim X Sep 8 '16 at 23:28
  • @TimX Because I'm new to system administration and should learn these stuff. I know how to create a new repository, how to use keys, how to use its commands and etc., I just want to see that how can I have multiple repos on my GitServer, and have multiple users with different permissions for using keys. For instance, I need someone to have access to all repos, but someone to only his/her repo. I'm using GitLab on my server at the moment since it has the feature. – Parsa Samet Sep 13 '16 at 10:00
  • 1
    Suspect your not installing the keys correctly - should not be associated with the git user (which is the su for the system), but associated with each user's gitlab profile. You need to setup a profile for each user with appropriate roles for each project and install the key via the user's profile to ensure it is setup correctly for gitlab rather than just copying the key into the ~git/.ssh/authorized_keys file. – Tim X Sep 14 '16 at 21:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.