gotsh - Game of Trees Shell
GOTSH(1) General Commands Manual GOTSH(1)
NAME
gotsh — Game of Trees Shell
SYNOPSIS
gotsh −c ‘git-receive-pack repository-path’ gotsh −c ‘git-upload-pack repository-path’ gotsh −c ‘weblogin [
hostname ]’
DESCRIPTION
gotsh is the network-facing interface to gotd(8). It implements the server-side part of the Git network protocol used by git(1) and got(1).
gotsh is not an interactive shell. gotsh is intended to be configured as the login shell of Git repository user accounts on servers running gotd(8). If users require a different login shell, gotsh can be installed in the command search path under the names git-receive-pack and git-upload-pack, or gitwrapper(1) can be used to select the appropriate command to run automatically.
The users can then interact with gotd(8) over the network. When users invoke commands such as got send and got fetch on client machines, got(1) will connect to the server with ssh(1). gotsh will facilitate communication between gotd(8) running on the server machine and the got(1) or git(1) program running on the client machine.
Users running gotsh should not have access to Git repositories by means other than accessing the unix socket of gotd(8) via gotsh.
The weblogin command provides user authentication for gotwebd(8). gotsh will connect to gotwebd(8) and obtain a login URL which allows browsing private repositories the user has been granted read access to in gotwebd.conf(5). If multiple servers are declared in gotwebd.conf(5) the hostname parameter is required and indicates the desired virtual host to use in the URL. If no hostname is specified and only one server is declared in gotwebd.conf(5) then the name of this server will be used in the URL.
It is recommended to restrict ssh(1) features available to users of gotsh. See the “EXAMPLES” section for details.
ENVIRONMENT
GOTD_UNIX_SOCKET
Set the path to the unix socket which gotd(8) is listening on. If not specified, the default path /var/run/gotd.sock will be used.
EXAMPLES
sshd_config(5) directives such as the following are recommended to protect the server machine and any systems reachable from it, especially if anonymous users are allowed to connect:
Match User
developer
DisableForwarding yes
PermitTTY no
It can be convenient to add all relevant users to a common group, such as “developers”, and then use this group as the Match criteria:
Match Group
developers
DisableForwarding yes
PermitTTY no
Anonymous users can be given public read-only access by using a gotd.conf(5) access rule such as the following:
repository "public" {
|
path "/var/git/public.git" |
||
|
permit ro anonymous |
}
The anonymous user account should have a publicly known password, or can be set up with an empty password in which case the user’s vipw(8) entry would look similar to this example:
anonymous::1002:1002::0:0:Anonymous:/home/anonymous:/usr/local/bin/gotsh
Use of an empty password must be explicitly allowed in sshd_config(5):
Match User
anonymous
PasswordAuthentication yes
PermitEmptyPasswords yes
DisableForwarding yes
PermitTTY no
And to tell security(8) to ignore the empty password, set PASSWDSKIP to the following in /etc/daily.local:
PASSWDSKIP="anonymous:/usr/local/bin/gotsh"
Obtain a gotwebd(8) login URL for got.example.com:
$ ssh got.example.com weblogin
If the web server at got.example.com serves virtual hosts then two hostnames must be provided. One for ssh(1) to connect to, and another to identify the virtual host served by gotwebd(8):
$ ssh got.example.com weblogin got.example.com
In practice both hostnames will often be the same, but this is not guaranteed. There is no reliable way determine the desired virtual host automatically. An ssh_config(5) entry like the following can save some typing:
Host weblogin
|
Hostname got.example.com | |
|
RemoteCommand weblogin %h |
The following command is now equivalent to the above:
$ ssh weblogin
SEE ALSO
gitwrapper(1), got(1), ssh(1), gotd.conf(5), gotwebd.conf(5), sshd_config(5), gotd(8), gotwebd(8), security(8)
AUTHORS
Stefan Sperling <[email protected]> GNU $Mdocdate$ GOTSH(1)