Differences between revisions 36 and 37
Revision 36 as of 2009-03-17 13:35:52
Size: 1935
Editor: ciphergoth
Comment: HgLogin now has its own page
Revision 37 as of 2009-03-17 13:48:47
Size: 2322
Editor: ciphergoth
Comment: Shamelessly promote my own mercurial-server above all other options
Deletions are marked like this. Additions are marked like this.
Line 7: Line 7:
[[TableOfContents]] == mercurial-server ==
Line 9: Line 9:
== How this works == mercurial-server provides the most complete and easiest-to-use solution to this problem for hosting a collection of repositories on Unix systems. Installing mercurial-server creates a new user, "hg", which will own all the repositories to be shared. Giving access to a new user is as simple as adding their SSH key to a special repository and pushing the changes. mercurial-server can enforce fine-grained permissions and logs all events.

 * [http://hg.opensource.lshift.net/mercurial-server/file/release_0.6/README]
 * [http://hg.opensource.lshift.net/mercurial-server/file/release_0.6/doc/]
 * [http://hg.opensource.lshift.net/mercurial-server/archive/release_0.6.tar.gz]

== Other options ==

There are two alternative systems for achieving the same end, though both require more work to maintain:

=== hg-ssh ===

  A python script available in [http://www.selenic.com/repo/hg-stable/raw-file/tip/contrib/hg-ssh contrib/hg-ssh]. Allowed repositories are managed directly in the authorized_keys file.

  Look at the start of the script for usage instructions.

  mercurial-server is descended from hg-ssh.

=== hg-login ===

  HgLogin is a system by MarcSchaefer for achieving the same end.

== How these work ==
Line 25: Line 47:

There are three alternative implementations of scripts which provide access only to
explicitly allowed repositories:

=== mercurial-server ===

  A set of tools available from [http://hg.opensource.lshift.net/mercurial-server/] which control access via a magic
  repository containing SSH keys and a rules file; changes to this repository change permissions automatically. For
  details see [http://hg.opensource.lshift.net/mercurial-server/file/tip/README].

=== hg-ssh ===

  A python script available in
  [http://www.selenic.com/repo/hg-stable/raw-file/tip/contrib/hg-ssh contrib/hg-ssh].
  Allowed repositories are managed directly in the authorized_keys file.

  Look at the start of the script for usage instructions.


=== hg-login ===

  HgLogin is a system by MarcSchaefer for achieving the same end.

As described on MultipleCommitters, one way of collaboration (the CVS-like model) is setting up a central [:Repository:repository] every user pushes his changes to and pulls the others' changes from. This page describes how to create such repositories accessible via a shared ssh account without needing to give full shell access to other people.

mercurial-server

mercurial-server provides the most complete and easiest-to-use solution to this problem for hosting a collection of repositories on Unix systems. Installing mercurial-server creates a new user, "hg", which will own all the repositories to be shared. Giving access to a new user is as simple as adding their SSH key to a special repository and pushing the changes. mercurial-server can enforce fine-grained permissions and logs all events.

Other options

There are two alternative systems for achieving the same end, though both require more work to maintain:

hg-ssh

hg-login

How these work

When accessing a remote repository via Mercurial's ssh repository type, hg basically does a

$ ssh hg.example.com hg -R /path/to/repos serve --stdio

and relies on ssh for authentication and tunneling. When using public key authentication, ssh allows limiting the user to one specific command, which can do all the sanity checks we want and then calls hg just like ssh would in the example above. Note that every user gets his own private key and his own entry in authorized_keys, which allows the scripts to distinguish between different users and thus enforce e.g. access permissions.

See also AclExtension, HgWebDirStepByStep.


CategoryWeb CategoryHowTo

SharedSSH (last edited 2021-03-19 07:37:31 by RobinMunn)