View source for Restricted shell

By default, FusionForge creates shell access for users that are members of a project.

This SSH access is used to commit to the SCM repositories, or to upload files to the [[Project websites|project's website]].

If you wish to restrict this access, e.g. to only Git, SVN or SFTP, you can configure a restricted shell.

== Example configuration ==

Let's document how to use the <code>git-shell</code> restricted shell. Alternatives exist such as [http://puszcza.gnu.org.ua/software/rush/ GNU Rush] and [http://www.pizzashack.org/rssh/ rssh].

* add <tt>/usr/bin/git-shell</tt> to <tt>/etc/shells</tt>
* define the <tt>core/user_default_shell</tt>, e.g. in <tt>/etc/fusionforge/config.ini.d/zzzz-local.ini</tt>:
 [core]
 user_default_shell = /usr/bin/git-shell

=== Adding an scp wrapper script to <tt>~/git-shell-commands/</tt> ===

Note: <tt>git-shell</tt> securely restricts shell access only if the user doesn't have access to its home directory.

The following script may be added to the user's <tt>~/git-shell-commands/scp</tt> to securely add support <code>scp</code>, by matching <code>^(scp .*-t /upload)</code>:
 #!/bin/sh
 
 cmd="$*"
 
 # check that command doesn't involve upwards path components in any
 # location to prevent, for instance, scp -t upload/../
 echo "$cmd" | fgrep '..' >/dev/null && echo "Forbidden command: scp $cmd" && exit
 
 case "$cmd" in
  -t\ --\ /home/groups/*/htdocs*) exec scp $cmd ;;
  -r\ -t\ --\ /home/groups/*/htdocs*) exec scp $cmd ;;
  -p\ -t\ --\ /home/groups/*/htdocs*) exec scp $cmd ;;
  -r\ -p\ -t\ --\ /home/groups/*/htdocs*) exec scp $cmd ;;
  *) echo "Forbidden command: scp $cmd" ;;
 esac

Then, the user will be able to scp to <tt>/home/groups/projname/htdocs/</tt> to upload the project's website files.

You may want to check GNU Rush and rssh though.

== See also ==

* [[Configuration]]: <code>core/use_shell</code> and <code>core/user_default_shell</code>
* [http://lists.fusionforge.org/pipermail/fusionforge-general/2012-May/001792.html Restricting ssh shell access for git] on [Fusionforge-general] 

[[Category:Admin documentation]]