Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gitlab 5.0 released, Gitolite now gone

blog.gitlab.org

Post reply on HN
Print view View original

71–80 of 96 posts

Re: Gitlab 5.0 released, Gitolite now gone

#71

Post by teraflop »

Hello71 wrote: post #69
__david__ wrote: post #67

Earlier quoted context omitted.

> If GitLab security were to be perfect, then this change would not affect security in any which way. Yes, it does: right now users can use ssh to push and pull repos on my machine using gitolite but they do not have shell access to the computer. "ssh git@gitlab.example.com" just prints a short message and exits. With this change they can all just ssh into the computer and have a bash prompt. Trying to make that secu…

Question: What happens when you type `ssh git@github.com /bin/bash`? That command doesn't use the shell set in /etc/passwd at all, and you authenticate successfully, so it must give you a shell, right? No.

> That command doesn't use the shell set in /etc/passwd at all

Yes it does. https://github.com/SimonWilkinson/openssh/blob/master/sessio...

Re: Gitlab 5.0 released, Gitolite now gone

#72

Post by Hello71 »

teraflop wrote: post #71
Hello71 wrote: post #69

Earlier quoted context omitted.

Question: What happens when you type `ssh git@github.com /bin/bash`? That command doesn't use the shell set in /etc/passwd at all, and you authenticate successfully, so it must give you a shell, right? No.

> That command doesn't use the shell set in /etc/passwd at all Yes it does. https://github.com/SimonWilkinson/openssh/blob/master/sessio...

Regardless:

  AUTHORIZED_KEYS FILE FORMAT
  ....
      command="command"
             Specifies that the command is executed whenever this key is used for
             authentication.  The command supplied by the user (if any) is
             ignored.  The command is run on a pty if the client requests a pty;
             otherwise it is run without a tty.  If an 8-bit clean channel is
             required, one must not request a pty or should specify no-pty.  A
             quote may be included in the command by quoting it with a backslash.
             This option might be useful to restrict certain public keys to per‐
             form just a specific operation.  An example might be a key that per‐
             mits remote backups but nothing else.  Note that the client may
             specify TCP and/or X11 forwarding unless they are explicitly prohib‐
             ited.  The command originally supplied by the client is available in
             the SSH_ORIGINAL_COMMAND environment variable.  Note that this
             option applies to shell, command or subsystem execution.  Also note
             that this command may be superseded by either a sshd_config(5)
             ForceCommand directive or a command embedded in a certificate.

Re: Gitlab 5.0 released, Gitolite now gone

#73

Post by oso96_2000 »

mbreese wrote: post #68
buster wrote: post #62

Last time i was installing gitlab after having the nightmare to install and maintain a gitorious installation and was really depressed that it felt like the same nightmare. Pages of pages of copy&paste instructions, followed by half a dozen issues that needed post-install fixing... no, never again.. I ended up installing gitblit and was amazed by the quick installation and features. Unpack&run! I can recommend gitbli…

I had the same issue a month or so ago. I needed to install a local Git repository and because I'd be working with people who had never used Git before, I wanted to have some kind of GUI for them. I looked at GitLab, Gitolite + gitweb, and Gitosis. GitLab's installation was the worst of the three. It was horrible, and seemed like it would have been impossible to maintain/upgrade. I really hope that the entire experie…

I'm nowhere near a ruby developer, so i don't understand how most of the things works, but had cero trouble installing gitlab. Even when it throws some strange (for me) errors on some gems, it was just a matter of googling to solve the problem.

Re: Gitlab 5.0 released, Gitolite now gone

#74

Post by [deleted] »

Hello71 wrote: post #72
teraflop wrote: post #71

Earlier quoted context omitted.

> That command doesn't use the shell set in /etc/passwd at all Yes it does. https://github.com/SimonWilkinson/openssh/blob/master/sessio...

Regardless: AUTHORIZED_KEYS FILE FORMAT .... command="command" Specifies that the command is executed whenever this key is used for authentication. The command supplied by the user (if any) is ignored. The command is run on a pty if the client requests a pty; otherwise it is run without a tty. If an 8-bit clean channel is required, one must not request a pty or should specify no-pty. A quote may be included in the co…

[deleted]

Re: Gitlab 5.0 released, Gitolite now gone

#75

Post by buster »

oso96_2000 wrote: post #73
mbreese wrote: post #68

Earlier quoted context omitted.

I had the same issue a month or so ago. I needed to install a local Git repository and because I'd be working with people who had never used Git before, I wanted to have some kind of GUI for them. I looked at GitLab, Gitolite + gitweb, and Gitosis. GitLab's installation was the worst of the three. It was horrible, and seemed like it would have been impossible to maintain/upgrade. I really hope that the entire experie…

I'm nowhere near a ruby developer, so i don't understand how most of the things works, but had cero trouble installing gitlab. Even when it throws some strange (for me) errors on some gems, it was just a matter of googling to solve the problem.

Some years back i was able to tolerate when a webapp needed serious fiddling in a) apache configs, b) php configs and c) manual mysql database setup.

Nowaday i expect something to run and have as few steps to install as possible. It wasn't even so much the many steps in between but the stuff that just didn't work as given in the installation guide. Turned out that some answers were in the gitlab Troubleshooting Guide. And then some stuff just didn't work, because at that point resque was removed (if i remember correctly, i don't even know what resque is and i don't really care, tbh). Now, after this took me 2 hours to get it running, half a day was spent with a) log in, b) find something not working, c) google, d) log into server and fix, e) repeat.

I'm no ruby guy, too, but i would've thought this goes much smoother nowadays.

I was using Gitlab for 1 or 2 weeks back then, but when the password reset didn't work it really made me think if i want to go through all that again on the next major update. So i turned to gitblit (which i rejected before because it can't do pull requests).

Edit: Don't get me wrong, i liked the Gitlab interface, it's very polished and nice, and what was working was working fine. Still i wouldn't want to maintain it. Maybe it's all better now with 5.0 :)

Re: Gitlab 5.0 released, Gitolite now gone

#76

Post by __david__ »

Hello71 wrote: post #72
teraflop wrote: post #71

Earlier quoted context omitted.

> That command doesn't use the shell set in /etc/passwd at all Yes it does. https://github.com/SimonWilkinson/openssh/blob/master/sessio...

Regardless: AUTHORIZED_KEYS FILE FORMAT .... command="command" Specifies that the command is executed whenever this key is used for authentication. The command supplied by the user (if any) is ignored. The command is run on a pty if the client requests a pty; otherwise it is run without a tty. If an 8-bit clean channel is required, one must not request a pty or should specify no-pty. A quote may be included in the co…

Got it, so the shell is still /bin/bash but they specify the command in the .ssh/authorize_keys file which means it cannot be overridden by the user. (I was under the mistaken impression that gitolite overrode the shell and not the command)

So your original point was correct: as long as the authorized_keys file is not corrupted, everything is good. Thanks for helping me understand!

Re: Gitlab 5.0 released, Gitolite now gone

#77

Post by sytse »

teraflop wrote: post #71
Hello71 wrote: post #69

Earlier quoted context omitted.

Question: What happens when you type `ssh git@github.com /bin/bash`? That command doesn't use the shell set in /etc/passwd at all, and you authenticate successfully, so it must give you a shell, right? No.

> That command doesn't use the shell set in /etc/passwd at all Yes it does. https://github.com/SimonWilkinson/openssh/blob/master/sessio...

You can find the commands that are allowed in the GitLab-shell here https://github.com/gitlabhq/gitlab-shell/blob/master/lib/git...

Re: Gitlab 5.0 released, Gitolite now gone

#78

Post by sytse »

buster wrote: post #75
oso96_2000 wrote: post #73

Earlier quoted context omitted.

I'm nowhere near a ruby developer, so i don't understand how most of the things works, but had cero trouble installing gitlab. Even when it throws some strange (for me) errors on some gems, it was just a matter of googling to solve the problem.

Some years back i was able to tolerate when a webapp needed serious fiddling in a) apache configs, b) php configs and c) manual mysql database setup. Nowaday i expect something to run and have as few steps to install as possible. It wasn't even so much the many steps in between but the stuff that just didn't work as given in the installation guide. Turned out that some answers were in the gitlab Troubleshooting Guide…

I'm sorry to hear you had trouble installing GitLab before. Installation should be a lot better now. We replaced resque with sidekick. Also there are pre installed images available from http://bitnami.com/stack/gitlab

Re: Gitlab 5.0 released, Gitolite now gone

#79

Post by sytse »

nonpme wrote: post #66
randx wrote: post #37

Earlier quoted context omitted.

In order to run GitLab w/o any tweaks you need 1GB Linode. You can start it on 512 but you need to setup unicorn to use only 1 worker and you need at least 200MB of swap

Is 1GB really requred for personal use? I thought about buying 256/512 VPS exclusively for GitLab, don't you think it will be enough for personal projects? Maybe someone who has the knowledge can write tutorial about configuring GL to run on average VPS?

A post about tuning GitLab for low memory consumption would be very useful indeed.

Re: Gitlab 5.0 released, Gitolite now gone

#80

Post by sytse »

timmow wrote: post #39
sytse wrote: post #5

Earlier quoted context omitted.

We're pragmatic about the development of GitLab. A lot of people want public projects, it is the most popular request for GitLab http://gitlab.uservoice.com/forums/176466-general/suggestion...

Public projects and the need to add every single developer to every single project they needed access to (no concept of teams) were the main reasons we moved from Gitlab to Github Enterprise

FYI GitLab has teams of users, groups of projects and public clone now. Completely public repo's is being discussed http://gitlab.uservoice.com/forums/176466-general/suggestion...
Post reply on HN