仅显示用户有权使用 gitweb 访问的 GIT 存储库
我目前正在尝试设置 GIT 存储库服务器，以便我们可以从 SVN 切换到 GIT。我几乎已经涵盖了所有内容，但还有一个问题。
当前设置如下：
- 所有开发人员（和非开发人员）都有一个用户帐户和帐户。正确的组，因为服务器是 NIS 客户端
- 所有存储库都在 /var/git/ 中制作
- 所有拉/推都是通过 ssh 完成的
到目前为止，这工作得很好，并且消除了对 gitosis 或 gitolite 的需要。
因为我想对我设置的 gitweb 包括路径信息的存储库有一个可浏览的概述。因为存储库是私有的，所以我通过 Perl AuthenNIS 设置了身份验证，这有效，但在这里我遇到了问题。
我们不希望所有开发人员都可以访问所有存储库，但 gitweb 只是显示它（apache 用户）可以读取的每个存储库。
所以我的问题是：是否可以让 gitweb 仅显示当前登录用户有权访问的 GIT 存储库？
可能的解决方案：
- 通过 .htaccess 进一步进行访问控制。 pathinfo 可以启用此功能，但不会阻止通过非 pathinfo URL 访问存储库（例如 /repo.git/ 不起作用，但 /gitweb.cgi?p=repo.git 可以
- ） /gitolite 环境并将其集成到 gitweb 中（本质上是 这个）。我想阻止这种情况，因为
- 让 gitweb 作为经过身份验证的 HTTP 用户运行的开销是不可取的。这将解决所有访问控制问题，但我不知道如何
- 与
$cgi->remote_user结合使用 gitweb 的$export_auth_hook似乎很有希望，但我的理解perl 的功能太有限，无法使用它（该钩子需要在显示/导出之前验证用户是否有权访问 repo 目录）
是否有人知道如何使 3 或 4 工作或有另一个 解决方案？
I currently am experimenting with setting up a GIT repository server so we can switch from SVN to GIT. I've got almost everything covered, but am left with an issue.
The current setup is as follows:
- All developers (and non-developers) have a user accounts & correct groups because the server is a NIS client
- All repos are made in /var/git/
- All pulling/pushing is done over ssh
This works perfectly so far, and eliminates the need for gitosis or gitolite.
Because I would like to have a browsable overview of the repositories I've set up gitweb including pathinfo. Because the repos are private I've set up authentication through Perl AuthenNIS and this works, but here I encounter a problem.
It is undesired that all developers have access to all repositories, but gitweb just shows every repository it (the apache user) can read.
So my question is: is it possible to make gitweb only show the GIT repo's the currently logged in user has access to?
Possible solutions:
- Further access control through .htaccess. The pathinfo would enable this but it wouldn't prevent the repo's from being accessed through non-pathinfo URLs (e.g. /repo.git/ wouldn't work but /gitweb.cgi?p=repo.git would)
- Setting up a full gitosis/gitolite environment and integrating it into gitweb (essentially this). I would like to prevent this because the overhead is undesirable
- Making gitweb run as the authenticated HTTP user. This would fix all the access control problems but I don't know how to do this
- gitweb's
$export_auth_hookin combination with$cgi->remote_userseems promising, but my understanding of perl is too limited to use it (the hook would need to verify that the user has permission to access the repo directory before showing/exporting it)
Is there anyone who knows how to make 3 or 4 work or has another solution?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果开发人员使用 ssh 在（我认为）他们自己的用户名下从存储库服务器推送/拉取，那么完成此操作的最简单方法可能是找到一种运行 gitweb< 的方法该用户身份下的 /code> 或
git。例如，找到一种在执行 gitweb 之前添加身份验证挂钩的方法。然后在
gitweb周围添加一个执行sudo -u $user gitweb.real的包装器，其中$user是经过身份验证的用户名。或者，您可以只包装 git 命令，即让 gitweb 执行一个包装器，该包装器执行 sudo -u $user {real-git-path}代码>.
要在 Apache 中实现针对 NIS/PAM 的身份验证，请查看 mod_auth_external
If developers are pushing/pulling from the repository server using ssh under (I presume) their own user names, then perhaps the easiest way to accomplish what this is to find a way to run
gitweborgitunder that user's identity.For instance, find a way to add an authentication hook before
gitwebis executed. Then add a wrapper aroundgitwebthat executessudo -u $user gitweb.realwhere$useris the authenticated user name.Or, you could just wrap the
gitcommand, i.e. havegitwebexecute a wrapper which does asudo -u $user {real-git-path}.For implementing authentication against NIS/PAM in Apache, have a look at mod_auth_external