4
4
Consider the following simple scenario where we will be serving Bazaar branches
5
5
that live on a single server. Those branches are in the subdirectories of
6
``/srv/bzr`` (or ``C:\\bzr``) and they will all be related to a single project
6
``/srv/bzr`` (or ``C:\bzr``) and they will all be related to a single project
7
7
called "ProjectX". ProjectX will have a trunk branch and at least one feature
8
8
branch. As we get further, we will consider other scenarios, but this will be
9
9
a sufficiently motivating example.
92
92
.. [#] The version of Bazaar installed on the server must be at least 2.1.0b1
93
93
or newer to support ``/~/`` in bzr+ssh URLs.
95
Using a restricted SSH account to host multiple users and repositories
96
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
98
Once you have a bzr+ssh setup using a shared repository you may want to share
99
that repository among a small set of developers. Using shared SSH access enables
100
you to complete this task without any complicated setup or ongoing management.
102
To allow multiple users to access Bazaar over ssh we can allow ssh access to a common
103
account that only allows users to run a specific command. Using a single account
104
simplifies deployment as no permissions management issues exist for the filesystem.
105
All users are the same user at the server level. Bazaar labels the commits with
106
each users details so seperate server accounts are not required.
108
To enable this configuration we update the ``~/.ssh/authorized_keys`` to include
109
command restrictions for connecting users.
111
In these examples the user will be called ``bzruser``.
113
The following example shows how a single line is configured::
115
command="bzr --serve --inet --allow-writes --directory=/srv/bzr",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-rsa AAA...= my bzr key
117
This command allows the user to access only bzr and disables other SSH use. Write
118
access to each repository in the directory ``/srv/bzr`` has been granted with ``--allow-writes``
119
and can be removed for individual users that should only require read access. The root of
120
the directory structure can be altered for each user to allow them to see only a subet
121
of the repositories available. The example below assumes two seperate repositories
122
for Alice and Bob. This method will not allow you to restrict access to part
123
of a repository, you may only restrict access to a single part of the directory structure::
125
command="bzr --serve --inet --allow-writes --directory=/srv/bzr/alice/",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-rsa AAA...= Alice's SSH Key
126
command="bzr --serve --inet --allow-writes --directory=/srv/bzr/bob/",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-rsa AAA...= Bob's SSH Key
127
command="bzr --serve --inet --allow-writes --directory=/srv/bzr/",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-rsa AAA...= Repo Manager SSH Key
129
Alice and Bob have access to their own repository and Repo Manager
130
has access to the each of their repositories. Users are not allowed access to any part of
131
the system except the directory specified. The bzr+ssh urls are simplified by
132
serving using ``bzr serve`` and the ``--directory`` option.
134
If Alice logs in she uses the following command for her fix-1023 branch::
136
$ bzr log bzr+ssh://bzruser@server.example.com/fix-1023
138
If Repo Manager logs in he uses the following command to access Alice's
141
$ bzr log bzr+ssh://bzruser@server.example.com/alice/fix-1023
added
removed
doc/en/admin-guide/simple-setups.txt
