git-annex-shell(1) | General Commands Manual | git-annex-shell(1) |
git-annex-shell - Restricted login shell for git-annex only SSH access
git-annex-shell [-c] command [params ...]
git-annex-shell is a restricted shell, similar to git-shell, which can be used as a login shell for SSH accounts.
Since its syntax is identical to git-shell's, it can be used as a drop-in replacement anywhere git-shell is used. For example it can be used as a user's restricted login shell.
Any command not listed below is passed through to git-shell.
Note that the directory parameter should be an absolute path, otherwise it is assumed to be relative to the user's home directory. Also the first "/~/" or "/~user/" is expanded to the specified home directory.
After content is received or dropped from the repository by git-annex-shell, it runs a hook, .git/hooks/annex-content (or hooks/annex-content on a bare repository). The hook is not currently passed any information about what changed.
To make a ~/.ssh/authorized_keys file that only allows git-annex-shell to be run, and not other commands, pass the original command to the -c option:
command="git-annex-shell -c
\"$SSH_ORIGINAL_COMMAND\"",no-agent-forwarding,no-port-forwarding,no-X11-forwarding
ssh-rsa AAAAB3NzaC1y[...] user@example.com
To further restrict git-annex-shell to a particular repository, and fully lock it down to read-only mode:
command="GIT_ANNEX_SHELL_DIRECTORY=/srv/annex
GIT_ANNEX_SHELL_LIMITED=true GIT_ANNEX_SHELL_READONLY=true git-annex-shell
-c \"$SSH_ORIGINAL_COMMAND\"",restrict ssh-rsa
AAAAB3NzaC1y[...] user@example.com
Obviously, ssh-rsa AAAAB3NzaC1y[...] user@example.com needs to replaced with your SSH key. The above also assumes git-annex-shell is available in your $PATH, use an absolute path if it is not the case. Also note how the above uses the restrict option instead of an explicit list of functionality to disallow. This only works in certain OpenSSH releases, starting from 7.1p2.
To only allow adding new objects to the repository, the GIT_ANNEX_SHELL_APPENDONLY variable can be used as well:
command="GIT_ANNEX_SHELL_DIRECTORY=/srv/annex GIT_ANNEX_SHELL_APPENDONLY=true git-annex-shell -c \"$SSH_ORIGINAL_COMMAND\"",restrict ssh-rsa AAAAB3NzaC1y[...] user@example.com
This will not keep an attacker from destroying the git history, as explained above. For this you might want to disallow certain operations, like branch deletion and force-push, with options from git-config(1). For example:
git config receive.denyDeletes true git config receive.denyNonFastForwards true
With this configuration, git commits can still remove files, but they will still be available in the git history and git-annex will retain their contents. Changes to git-annex branch, however, can negatively impact git-annex's location tracking information and might cause data loss. To work around this problem, more complex hooks are required, see for example the update-paranoid hook in the git source distribution.
Joey Hess <id@joeyh.name>
<http://git-annex.branchable.com/>