In the company I'm working someone has restricted access to all users
to only use cvs via cvssh.pl script (source at the end of message)
taken from gforge. This script is set as a shell for all users. Now I
would like to change it so I can run git too. I've tried by adding
'git', 'git-upload-pack', 'git-receive-pack' and 'git-shell' in the
array @allowed_commands. After that if I try to clone existing
repository with:
git clone ssh://testuser@server_name/tmp/test.git
I get following error:
fatal: ''/tmp/test.git'': unable to chdir or not a git archive
fatal: The remote end hung up unexpectedly
I first thought that testuser doesn't have permissions to read
directory /tmp/test.git so I changed mode and gave r+w permissions
recursively on that folder, but result was same.
There is no way I can avoid this perl script (company policy) but I
can change it. Problem is that I do not know Perl so much and I do not
know what git is exactly doing behind the scene when it is run via
ssh. Can anyone tell me why this perl script doesn't allow git to run
properly and what has to be changed to enable git?
#! /usr/bin/perl -w
#
# $Id: cvssh.pl 3987 2005-02-26 22:59:11Z tperdue $
#
# "Shell" for a restricted account, limiting the available commands
# Roland Mas, debian-sf (Sourceforge for Debian)
#
# Inspired from the grap.c file in Sourceforge 2.5
use strict ;
use vars qw/ @allowed_options @allowed_commands $errmsg @cmd / ;
use subs qw/ &reject / ;
no locale ;
@allowed_options = ('-c', '-e') ;
@allowed_commands = ('cvs') ;
# Clean up our environment
delete @ENV{qw(IFS CDPATH ENV BASH_ENV PATH)};
@cmd = split (/ +/, $ENV{SSH_CLIENT});
if (scalar (grep {/192.168.0/} @cmd) == 0) {
$errmsg = "Client address not allowed." ;
&reject ;
}
if ($#ARGV != 1) {
if ($#ARGV < 1) {
$errmsg = "Not enough arguments." ;
} else {
$errmsg = "Too many arguments." ;
}
&reject ;
}
if (scalar (grep { $_ eq $ARGV[0] } @allowed_options) == 0) {
$errmsg = "Option not allowed." ;
&reject ;
}
@cmd = split (/ +/, $ARGV[1]) ;
if (scalar (grep { $_ eq $cmd[0] } @allowed_commands) == 0) {
$errmsg = "Command not allowed." ;
&reject ;
}
exec @cmd ;
sub reject {
print "This is a restricted account.\n" .
"You cannot execute anything here.\n" .
# $errmsg . "\n" .
"Goodbye.\n" ;
exit 1 ;
}
From: Johannes Schindelin <hidden> Date: 2016-06-15 22:46:14
Hi,
On Wed, 18 Feb 2009, Bosko Ivanisevic wrote:
In the company I'm working someone has restricted access to all users
to only use cvs via cvssh.pl script (source at the end of message)
taken from gforge. This script is set as a shell for all users. Now I
would like to change it so I can run git too. I've tried by adding
'git', 'git-upload-pack', 'git-receive-pack' and 'git-shell' in the
array @allowed_commands. After that if I try to clone existing
repository with:
git clone ssh://testuser@server_name/tmp/test.git
I get following error:
fatal: ''/tmp/test.git'': unable to chdir or not a git archive
fatal: The remote end hung up unexpectedly
I first thought that testuser doesn't have permissions to read
directory /tmp/test.git so I changed mode and gave r+w permissions
recursively on that folder, but result was same.
r+w? Not a+rwx?
And only on /tmp/test.git/, or also on /tmp/?
A better way would be to use 'sudo -u testuser git ls-remote
/tmp/test.git' if sudo is available (you haven't revealed useful
information about the host).
There is no way I can avoid this perl script (company policy) but I
can change it. Problem is that I do not know Perl so much and I do not
know what git is exactly doing behind the scene when it is run via
ssh.
I'd use 'system("some shell >&2");' to try to debug it.
Hth,
Dscho
Hi,
On Wed, Feb 18, 2009 at 2:24 PM, Johannes Schindelin
[off-list ref] wrote:
Hi,
On Wed, 18 Feb 2009, Bosko Ivanisevic wrote:
quoted
In the company I'm working someone has restricted access to all users
to only use cvs via cvssh.pl script (source at the end of message)
taken from gforge. This script is set as a shell for all users. Now I
would like to change it so I can run git too. I've tried by adding
'git', 'git-upload-pack', 'git-receive-pack' and 'git-shell' in the
array @allowed_commands. After that if I try to clone existing
repository with:
git clone ssh://testuser@server_name/tmp/test.git
I get following error:
fatal: ''/tmp/test.git'': unable to chdir or not a git archive
fatal: The remote end hung up unexpectedly
I first thought that testuser doesn't have permissions to read
directory /tmp/test.git so I changed mode and gave r+w permissions
recursively on that folder, but result was same.
r+w? Not a+rwx?
And only on /tmp/test.git/, or also on /tmp/?
A better way would be to use 'sudo -u testuser git ls-remote
/tmp/test.git' if sudo is available (you haven't revealed useful
information about the host).
Thanks for your reply. Here are more data. System is SuSe 10.3. On the
test server which has same setup but I can change shell when I change
testuser's shell to /bin/bash I can regularly clone git repository
from remote machine, so all permissions are set correctly. Besides,
output of:
git ls-remote ssh://testuser@server_name:/tmp/test.git
is:
3446c5347e0563cb87e1d8951c57b7f36996f44b HEAD
3446c5347e0563cb87e1d8951c57b7f36996f44b refs/heads/master
That leads me to conclusion that perl's exec command makes some mess
which prevents git of running correctly.
quoted
There is no way I can avoid this perl script (company policy) but I
can change it. Problem is that I do not know Perl so much and I do not
know what git is exactly doing behind the scene when it is run via
ssh.
I'd use 'system("some shell >&2");' to try to debug it.
I didn't understand this part. If I change
exec @cmd;
command from perl script to:
system("/bin/bash >&2);
git clone just hangs on the client side. I guess I did something wrong
but don't know what.
Regards,
Bosko
From: Johannes Schindelin <hidden> Date: 2016-06-15 22:46:14
Hi,
On Wed, 18 Feb 2009, Bosko Ivanisevic wrote:
On Wed, Feb 18, 2009 at 2:24 PM, Johannes Schindelin
[off-list ref] wrote:
quoted
On Wed, 18 Feb 2009, Bosko Ivanisevic wrote:
quoted
In the company I'm working someone has restricted access to all users
to only use cvs via cvssh.pl script (source at the end of message)
taken from gforge. This script is set as a shell for all users. Now I
would like to change it so I can run git too. I've tried by adding
'git', 'git-upload-pack', 'git-receive-pack' and 'git-shell' in the
array @allowed_commands. After that if I try to clone existing
repository with:
git clone ssh://testuser@server_name/tmp/test.git
I get following error:
fatal: ''/tmp/test.git'': unable to chdir or not a git archive
fatal: The remote end hung up unexpectedly
I first thought that testuser doesn't have permissions to read
directory /tmp/test.git so I changed mode and gave r+w permissions
recursively on that folder, but result was same.
r+w? Not a+rwx?
And only on /tmp/test.git/, or also on /tmp/?
A better way would be to use 'sudo -u testuser git ls-remote
/tmp/test.git' if sudo is available (you haven't revealed useful
information about the host).
Thanks for your reply. Here are more data. System is SuSe 10.3. On the
test server which has same setup but I can change shell when I change
testuser's shell to /bin/bash I can regularly clone git repository from
remote machine, so all permissions are set correctly. Besides, output
of:
git ls-remote ssh://testuser@server_name:/tmp/test.git
is:
3446c5347e0563cb87e1d8951c57b7f36996f44b HEAD
3446c5347e0563cb87e1d8951c57b7f36996f44b refs/heads/master
That leads me to conclusion that perl's exec command makes some mess
which prevents git of running correctly.
Maybe. Maybe it is also unsetting ENV which causes grief.
quoted
quoted
There is no way I can avoid this perl script (company policy) but I
can change it. Problem is that I do not know Perl so much and I do
not know what git is exactly doing behind the scene when it is run
via ssh.
I'd use 'system("some shell >&2");' to try to debug it.
I didn't understand this part. If I change
exec @cmd;
command from perl script to:
system("/bin/bash >&2);
git clone just hangs on the client side. I guess I did something wrong
but don't know what.
I did not mean to replace the exec. Rather, I meant you could do
something like
system('ls -l /tmp/test.git >&2');
to see what is actually happening. I mean, it could be that for some
reason I do not understand, the whole thing runs in a chroot or some such.
Ciao,
Dscho