1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
# git.syndamia.com CLI
Command-line utilities for managing my git repositories (creating a new repo, making it public/private, ...).
## Usage
The way I use them is by ssh-ing into my server in a chroot jail, which contains these, and only these, tools.
I'll be the only one directly using <https://git.syndamia.com>, so I've opted to *not* use a software forge or any other fine-grained access control program (e.g. [gitolite](https://gitolite.com/gitolite/index.html)).
As you'll see from the `new` script, repositories are stored as bare and [git over ssh](https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols.html#_the_ssh_protocol) is used for push/pull operations (thank you [tsoding](https://www.youtube.com/watch?v=iuIdBfjL62s)).
## Setup
Do note, I've only done this once for my server, manually.
If ever do it again, I'll setup scripts for an automated configuration.
### chroot jail
The best tutorial for a n00b like me was <https://www.tecmint.com/restrict-ssh-user-to-directory-using-chrooted-jail/>.
[Appendix B.7](https://web.archive.org/web/20260424212124/https://www.debian.org/doc/manuals/securing-debian-manual/chroot-ssh-env.en.html) from the severely outdated Securing Debian Manual also helped.
Some extra sshd configuration options which should always be added are:
```
PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
```
Documentation can be found on the [sshd_config man page](https://www.man7.org/linux/man-pages/man5/sshd_config.5.html).
### External dependencies
The primary utilities in this repository are simple shell scripts, however for them to work, a shell and some UNIX programs need to be available.
Since I'm jailing the ssh-ed user, every program, alongside its dynamically-linked libraries, needs to be copied over.
All `.list` files contain newline-separated names of **external** files and directories, relative to the root directory, which need to be **copied** into the jail root.
- `libs.list` - all needed dynamically-allocated libraries
- `bins.list` - all needed precompiled binaries.
- `devs.list` - all needed devices (they are all pseudo-devices, not related to actual hardware)
You also **must create `/tmp` directory**!
Otherwise, git commands will not work properly.
|
