Ssh – Git: push via ssh to a root owned repository with ssh root logins disabled

gitpuppetpuppetmasterrootssh

is that even possible?

Summary, i'm running puppet master on a server and ideally we want root logins via ssh disabled, we want to force all access via sudo if root access required

however we have puppet installed using a git repo to manage the manifests, this repo is currently owned by root and currently i only know of 2 solutions

  1. (less ideal) allow root access via key auth only – if so, what can i lock it down to to only allow the git push commands?
  2. own the repo in /etc/puppet as a different owner – will puppet work reliably with this?
  3. Could relevant Sudo config and command work around this?

Best Answer

Git repos can be configured to maintain group write permissions (option --shared when creating the repository). Using that, then you can add any accounts that need access to the repository to a particular group, so that they can access it.

I do that for our git server. I also put a symlink in each user's home directory to each repository they have access too, so everyone can access with a relative URL.

Related Topic