yuki-kimoto / gitprep

Portable GitHub system into your own server
http://gitprep.yukikimoto.com/
906 stars 118 forks source link

using ~/.ssh/authorized_keys for the gitprep authorized keys prevents normal ssh logging in #194

Closed emil-perhinschi closed 1 year ago

emil-perhinschi commented 1 year ago

Using ~/.ssh/authorized_keys for the gitprep web app authorized keys appears to interfere with regular ssh use.

While changing the default will impact older installs maybe there should be a recommendation in the gitprep.conf to use a custom authorized keys file such as ~/.ssh/gitprep_authorized_keys ?

I'm using ~/.ssh/gitprep_authorized_keys on my server and it appears to work fine so far ... but I suppose there might be strong reasons to take over ~/.ssh/authorized_keys that I am not aware of yet.

yuki-kimoto commented 1 year ago

I have a question.

Is ~/.ssh/gitprep_authorized_keys needed to be written in sshd.conf on the SSH server?

emil-perhinschi commented 1 year ago

did not think about that, I'll investigate

How is the command in the authorized_files used by gitprep ? Never used that feature.

I'll make a few local users that don't need to login remotely and upload repos with them and see what breaks ...

yuki-kimoto commented 1 year ago

How is the command in the authorized_files used by gitprep ?

This allows the user to resister public keys.

And the user can push and fetch the user's Git repository via ssh with the public key authentication.

The setting is saved into ~/.ssh/authorized_keys currently.

emil-perhinschi commented 1 year ago

I meant this 'command="/home/emilper/work/perl/gitprep/script/../script/gitprep-shell emilper"' ... does it do anything else besides restricting git users from logging in with ssh ?

Anyway, renaming the "authorized_keys" file used by gitprep breaks it, for me it worked only because I was using the same key to log in via ssh and to authenticate to git. I guess ssh users should not be the same as git users ... good thing I asked.

Are the tests in the ./xt folder supposed to work ?

yuki-kimoto commented 1 year ago

I meant this 'command="/home/emilper/work/perl/gitprep/script/../script/gitprep-shell emilper"' ... does it do anything else besides restricting git users from logging in with ssh ?

Restricting git users(Owner + Colaborators) from logging in with ssh and executing git shell -c command to communicate(fetch/pull) Git repository.

yuki-kimoto commented 1 year ago

Can you try to implement the bug fix you have in mind?

The changing of the default behavior is OK.

yuki-kimoto commented 1 year ago

Are the tests in the ./xt folder supposed to work ?

This is private tests. If you have the same testing environment as me, the test can be run.

emil-perhinschi commented 1 year ago

Can you try to implement the bug fix you have in mind?

It was not a bug, only a misunderstanding on my part on how things are supposed to work, so I'll leave the authorized_file handling alone :-) .

emil-perhinschi commented 1 year ago

This is private tests. If you have the same testing environment as me, the test can be run.

thank you

the issue was a misunderstanding on my part so I'll close it