Git – How to Tell Git Which Private Key to Use for a User Without Home Folder

gitsshssh-keys

I was reading the question Tell git which private key to use, and the answer doesn't apply for a case were the user doesn't have any home directory.

We're setting up a Jenkins server right now, and the user who run Jenkins doesn't have any home folder. But that particular user must access a GIT repository.

How can the user running GIT use a key authentication?

Best Answer

The environment variable GIT_SSH tells git what ssh exectutable to use. So you could create a script something like:

#!/bin/bash
/usr/bin/ssh -i /path/to/identity.file "$@"

Then chmod it executable, and set GIT_SSH=/path/to/sshscript

Related Solutions

SSH – How to Tell Git Which Private Key to Use

In ~/.ssh/config, add:

Host github.com
 HostName github.com
 IdentityFile ~/.ssh/id_rsa_github

If the config file is new, you might need to do chmod 600 ~/.ssh/config

Now you can do git clone git@github.com:{ORG_NAME}/{REPO_NAME}.git

Where {ORG_NAME} is your GitHub user account (or organization account)'s GitHub URI name.
- Note that there is a colon : after github.com instead of the slash / - as this is not a URI.
And {REPO_NAME} is your GitHub repo's URI name
For example, for the Linux kernel this would be git clone git@github.com:torvalds/linux.git).

NOTE: On Linux and macOS, verify that the permissions on your IdentityFile are 400. SSH will reject, in a not clearly explicit manner, SSH keys that are too readable. It will just look like a credential rejection. The solution, in this case, is:

chmod 400 ~/.ssh/id_rsa_github

Setting up a shared remote git repository without root privileges (solved) using ssh keys to manage per user access

Possible solution:

As I was typing the question I came up with a solution. But it seems to me there must be a simpler and more secure solution to this problem. What I did was change the value of 'command' in the authorized_keys file to:

command="~/somescript.sh"

And 'somescript.sh' contains:

#!/bin/bash
ALLOW=(
    '/home/<user>/repository1.git'
    '/home/<user>/repository2.git'
)

case $SSH_ORIGINAL_COMMAND in
    "git-receive-pack"*|"git-upload-pack"*|"git-upload-archive"*)
        GITPATH=$(echo $SSH_ORIGINAL_COMMAND | sed -r "s:.*'([^']*)'.*:\1:g")
        ALLOWED="false"
        for ((i=0; i < ${#ALLOW[@]}; i++)); do
            if [ "${ALLOW[$i]}" == "$GITPATH" ]; then
                ALLOWED="true"; break;
            fi
        done

        if [ "$ALLOWED" == "true" ]; then
            eval "git-shell -c \"$SSH_ORIGINAL_COMMAND\""
        else
            echo "[ERROR] ACCESS DENIED" >&2
            exit 1
        fi
        ;;
    *)
        echo "[ERROR] Only git commands are allowed!" >&2
        exit 1
        ;;
esac

In the script I'm taking advantage of the fact that the commands git clone, git push and git pull produce on the REMOTE side:

git-upload-pack '<path>/<to>/<repository>', or
git-receive-pack '<path>/<to>/<repository>'

I specify repositories in variable ALLOW that are allowed to be accessed through the ssh key that uses the script, and simply compare them to the path specified in the issued git command (variable GITPATH). There is a security risk though, when multiple git commands are issued in one line. If the command contains at least one mention of an allowed repository, it executes the entire command. Any suggestions on improvement?

Best Answer

Related Solutions

SSH – How to Tell Git Which Private Key to Use

Setting up a shared remote git repository without root privileges (solved) using ssh keys to manage per user access

Related Question