How goes gitHub restrict access only with sshKey?

Question

I'm wandering how does gitHub restrict repo access only by using sshKey. Everybody is connecting using 'git' user... but the access is restricted only to YOUR repository.

So how is that possible?

Thanks in advance.

Richard Hansen · Accepted Answer · 2013-03-03 18:16:59Z

3

GitHub is exploiting a feature of OpenSSH. See the section "AUTHORIZED_KEYS FILE FORMAT" in the sshd(8) man page. It says that each line in the authorized_keys file consists of the following:

<options> <keytype> <base64-encoded key> <comment>

One of the supported options is command:

command="command" Specifies that the command is executed whenever this key is used for authentication. The command supplied by the user (if any) is ignored.

Thus, GitHub can do stuff like this in their ~git/.ssh/authorized_keys file:

command="foo -u user1" <user1's key stuff here>
command="foo -u user2" <user2's key stuff here>

Now whenever user1 logs in, the server runs foo -u user1. Thus, the foo script knows that user1 logged in, not some other user.

answered Mar 3, 2013 at 18:16

Richard Hansen

54.8k20 gold badges93 silver badges101 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

user1809923 Over a year ago

and the "foo script" handles the following repository access? Is there an example how to do that part? Thanks!

Collectives™ on Stack Overflow

How goes gitHub restrict access only with sshKey?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related