Differences between revisions 40 and 41
Revision 40 as of 2009-12-18 14:20:23
Size: 2540
Editor: ciphergoth
Comment: Now mercurial-server ahs a web page, link to that.
Revision 41 as of 2010-04-30 12:03:05
Size: 2654
Editor: PaulBoddie
Comment: Tidied the formatting somewhat.
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
This page describes how to create repositories
accessible via a '''single shared ssh account''' without needing to give full shell access
to other people. That's just one of many ways to make your repository available to MultipleCommitters, and not necessarily the most common. See PublishingRepositories for a good overview of many ways to allow others to interact with your repository.
= Shared SSH =

{{{#!wiki tip
This page describes how to create repositories accessible via a '''single shared SSH account''' without needing to give full shell access to other people. This is just one of many ways to make your repository available to [[MultipleCommitters|multiple committers]], and not necessarily the most common. See PublishingRepositories for a good overview of many ways to allow others to interact with your repository.
}}}
Line 7: Line 9:
/!\ This is not '''''the''' mercurial server''. This is a piece of software for effectively letting a single shared ssh account be safely used by multiple people. If you're just looking to make your repository available read PublishingRepositories for a list of options. {{{#!wiki note
Despite its name, this is not the only Mercurial server available. This is a piece of software for effectively letting a single shared SSH account be safely used by multiple people. If you're just looking to make your repository available, read PublishingRepositories for a list of options.
}}}
Line 9: Line 13:
mercurial-server provides the most complete and easiest-to-use solution to this problem for hosting a collection of repositories on Unix systems. Installing mercurial-server creates a new user, "hg", which will own all the repositories to be shared. Giving access to a new user is as simple as adding their SSH key to a special repository and pushing the changes. mercurial-server can enforce fine-grained permissions and logs all events. mercurial-server provides the most complete and easiest-to-use solution to this problem for hosting a collection of repositories on Unix systems. Installing mercurial-server creates a new user, `hg`, which will own all the repositories to be shared. Giving access to a new user is as simple as adding their SSH key to a special repository and pushing the changes. mercurial-server can enforce fine-grained permissions and logs all events.
Line 13: Line 17:
  mercurial-server is descended from hg-ssh. mercurial-server is descended from hg-ssh.
Line 17: Line 21:
  hg-ssh is a python script available in [[http://www.selenic.com/repo/hg-stable/raw-file/tip/contrib/hg-ssh|contrib/hg-ssh]] and was probably installed along with your mercurial software. Allowed repositories are managed directly in the authorized_keys file. hg-ssh is a python script available in [[http://www.selenic.com/repo/hg-stable/raw-file/tip/contrib/hg-ssh|contrib/hg-ssh]] and was probably installed along with your Mercurial software. Allowed repositories are managed directly in the `authorized_keys` file.
Line 19: Line 23:
  Look at the start of the script for usage instructions. When possible use the version that matches your installed version of mercurial.
Look at the start of the script for usage instructions. When possible use the version that matches your installed version of Mercurial.
Line 24: Line 27:
  HgLogin is a system by MarcSchaefer for creating restricted shared user accounts. HgLogin is a system by MarcSchaefer for creating restricted shared user accounts.
Line 28: Line 31:
When accessing a remote repository via Mercurial's ssh repository type, ''hg''
basically does a
When accessing a remote repository via Mercurial's `ssh` repository type, `hg` basically does the following:
Line 35: Line 37:
and relies on ssh for authentication and tunneling. When using public key
authentication, ssh allows limiting the user to one specific command, which
can do all the sanity checks we want and then calls ''hg'' just like ssh would
It relies on `ssh` for authentication and tunneling. When using public key
authentication, `ssh` allows limiting the user to one specific command, which
can do all the sanity checks we want and then calls `hg` just like `ssh` would
Line 39: Line 41:
his own entry in authorized_keys, which allows the scripts to distinguish
between different users and thus enforce e.g. access permissions.
his own entry in `authorized_keys`, which allows the scripts to distinguish
between different users and thus enforce things like access permissions.

Shared SSH

This page describes how to create repositories accessible via a single shared SSH account without needing to give full shell access to other people. This is just one of many ways to make your repository available to multiple committers, and not necessarily the most common. See PublishingRepositories for a good overview of many ways to allow others to interact with your repository.

mercurial-server

Despite its name, this is not the only Mercurial server available. This is a piece of software for effectively letting a single shared SSH account be safely used by multiple people. If you're just looking to make your repository available, read PublishingRepositories for a list of options.

mercurial-server provides the most complete and easiest-to-use solution to this problem for hosting a collection of repositories on Unix systems. Installing mercurial-server creates a new user, hg, which will own all the repositories to be shared. Giving access to a new user is as simple as adding their SSH key to a special repository and pushing the changes. mercurial-server can enforce fine-grained permissions and logs all events.

mercurial-server is descended from hg-ssh.

hg-ssh

hg-ssh is a python script available in contrib/hg-ssh and was probably installed along with your Mercurial software. Allowed repositories are managed directly in the authorized_keys file.

Look at the start of the script for usage instructions. When possible use the version that matches your installed version of Mercurial.

hg-login

HgLogin is a system by MarcSchaefer for creating restricted shared user accounts.

How these work

When accessing a remote repository via Mercurial's ssh repository type, hg basically does the following:

$ ssh hg.example.com hg -R /path/to/repos serve --stdio

It relies on ssh for authentication and tunneling. When using public key authentication, ssh allows limiting the user to one specific command, which can do all the sanity checks we want and then calls hg just like ssh would in the example above. Note that every user gets his own private key and his own entry in authorized_keys, which allows the scripts to distinguish between different users and thus enforce things like access permissions.

See also AclExtension, HgWebDirStepByStep, PublishingRepositories, and MultipleCommitters


CategoryWeb CategoryHowTo

SharedSSH (last edited 2020-05-03 08:02:54 by timeless)