We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo:

  1. Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This will allow the user to access Git over HTTPS.
  2. Poke a hole in the firewall to allow traffic to the Git repo on SSH. This will allow the user to access Git over SSH.

We have another policy that requires use of cert/keys based authentication instead of a static user/password. So this rules out Option #1. But we are not comfortable with poking a hole in the Firewall.

What options do we have? Is there a Reverse HTTP Proxy like solution for SSH as well?

  • 1
    You're missing a third option: use SSL client certificate with Git HTTPS. – Lie Ryan Feb 6 at 2:42
  • @LieRyan, can you please point me to some documentation on how to set this up? – Saqib Ali Feb 6 at 14:42
  • What Git server are you using to share Git repos? – slm Mar 8 at 4:35
  • @slm , we are using GitLab – Saqib Ali May 15 at 18:43

If you're thinking of SSH certs does this mean these are internal users who can be forced to use additional security measures? Examples:

  • VPN

  • SSH Jump server - users connect here first and then use port forwarding to access your git host(s). You could insist on two separate sets of credentials too.

  • Does GIT work over SSH Jump server? – Saqib Ali Feb 6 at 0:13
  • Not tried git specifically (yet), but if it goes over SSH it should work - might need to set it to localhost:tunnel-port and/or adjust hosts file. I frequently tunnel multiple applications over SSH (including tunnels in tunnels) and it works really well, although if apps use specific ports you can't run 2 instances to 2 different hosts at the same time. – Richard N Feb 6 at 0:45
  • 2
    Git will use your .ssh/config file. If you configure your ssh jumps from the config file, it'll use those jump servers transparently. – Lie Ryan Feb 6 at 2:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.