linux服務器上搭建gitolite實現對git server的版本庫的權限控制

一、環境介紹：

1.1Git賬戶管理機器manage
ip：10.0.0.56

[root@manage ~]# cat /etc/redhat-release 
CentOS release 6.7 (Final)
[root@manage ~]# hostname
manage
[root@manage ~]# tail -2 /etc/hosts
10.0.0.56 manage
10.0.0.11 git-server

1.2.git遠程版本庫git-server
git遠程版本庫ip:10.0.0.11

[root@git-server ~]# cat /etc/redhat-release 
CentOS release 6.7 (Final)
[root@git-server ~]# hostname
git-server
[root@git-server ~]# tail -2 /etc/hosts
10.0.0.11 git-server
10.0.0.56 server

二、安裝部署

2.1在git賬戶管理機器上（10.0.0.56）操作：

2.1.1安裝git
[root@manage ~]# yum install git –y

2.1.2創建公鑰和私鑰
Git賬戶管理員需要在自己機器（10.0.0.56）上創建SSH公鑰/私鑰對。

ssh-keygen -f ~/.ssh/git-admin

[root@manage ~]# ll .ssh/
git-admin git-admin.pub known_hosts
2.1.3配置config文件
爲了方便管理和不至於和其他公鑰私鑰混淆，先配置下SSH客戶端的文件 ~/.ssh/config，
可以通過創建主機別名，在連接主機時，使用特定的公鑰。例如 ~/.ssh/config 文件中的下列配置

[root@manage ~]# cat .ssh/config 
host git-server
  user git
  hostname 10.0.0.11
  port 22
  identityfile ~/.ssh/git-admin

把10.0.0.56管理員機器上的公鑰copy到git-server(10.0.0.11)服務器上，

[root@manage ~]# scp .ssh/git-admin.pub git-server:/tmp/

提示：
注意1.git-server機器的sshd端口是必須是22端口,否則在配置免祕鑰進行git提交代碼時，會提交失敗的
注意2.Git賬戶管理機器manage（10.0.0.56）上的/root/.ssh/config文件權限必須是600，否則在後續添加公鑰時，會報錯，提示權限不允許

[root@manage ~]# ll /root/.ssh/config
-rw-rw-r-- 1 root root 99 Mar 29 11:28 /root/.ssh/config
[root@manage ~]# chmod 600 /root/.ssh/config
[root@manage ~]# ll /root/.ssh/config 
-rw------- 1 root root 99 Mar 29 11:28 /root/.ssh/config

2.2在git-server遠程版本庫機器上操作：

在git-server git遠程版本庫（ip:10.0.0.11）機器上安裝gitolite軟件來管理git版本庫賬戶
在Git-server git遠程版本庫安裝git
參考文檔：
http://blog.sina.com.cn/s/blog_4b5039210102e3r3.html

說明：
Gitolite其實也是一個git repository，首先在git-server機器上安裝好後，在client端manage機器上把server上的repository clone下來，在本地做一些更改，再push回server，server端的hooks會根據push上來的配置來更新權限。
在git-server 上操作：

2.2.1在git-server 機器上創建git用戶

useradd git
passwd  git 
123456

2.2.2在git-server上安裝git和下載gitolite

在git的用戶目錄下執行下載gitolite軟件包：

[root@git-server ~]# yum install git -y
 [root@git-server ~]# su - git
[git@git-server ~]$ git clone https://github.com/sitaramc/gitolite
Initialized empty Git repository in /home/git/gitolite/.git/
 remote: Counting objects: 9385, done.
remote: Total 9385 (delta 0), reused 0 (delta 0), pack-reused 9385
Receiving objects: 100% (9385/9385), 2.96 MiB | 95 KiB/s, done.
Resolving deltas: 100% (5805/5805), done.

2.2.3安裝gitolite

[git@git-server ~]$ mkdir bin
[git@git-server ~]$ gitolite/install -to $HOME/bin
[git@git-server ~]$ ls
bin  gitolite
[git@git-server ~]$ cd bin
[git@git-server bin]$ ls
commands  gitolite  gitolite-shell  lib  syntactic-sugar  triggers  VERSION  VREF

會在bin下生成一個gitolite可執行文件

必須先在10.0.0.56機器把git-admin.pub公鑰先拷貝到git-server10.0.0.11機器上

[root@manage ~]# scp .ssh/git-admin.pub git-server:/tmp/git-admin.pub
[git@git-server bin]$ gitolite setup -pk /tmp/git-admin.pub
[git@git-server ~]$ cd bin/
[git@git-server bin]$ ls
gitolite
[git@git-server bin]$ gitolite setup -pk /tmp/git-admin.pub
Initialized empty Git repository in /home/git/repositories/gitolite-admin.git/
Initialized empty Git repository in /home/git/repositories/testing.git/
WARNING: /home/git/.ssh missing; creating a new one
    (this is normal on a brand new install)
WARNING: /home/git/.ssh/authorized_keys missing; creating a new one
    (this is normal on a brand new install)
[git@git-server bin]$

此命令會在你的~/repositories/目錄生成兩個repository：gitolite-admin.git和testing.git

[git@git-server ~]$ cd repositories/
[git@git-server repositories]$ ls
gitolite-admin.git  testing.git
[git@git-server bin]$ ll /home/git/repositories/
total 8
drwx------ 8 git git 4096 Jul 23 15:53 gitolite-admin.git
drwx------ 7 git git 4096 Jul 23 15:53 testing.git

用戶目錄下生成一個project.list，默認裏面有一個testing的git的project

[git@git-server ~]$ more projects.list 
testing.git

到此處gitolite安裝完畢！

2.3再回到在manage端機器上操作：

克隆 git-server版本庫上的gitolite-admin到manage賬戶管理端機器
！！！注意:

命令一定要是git clone git-server:gitolite-admin
而不是：git clone git-server:/home/git/repositories/gitolite-admin
更不是：git clone git-server:gitolite-admin.git

[root@manage ~]# git clone git-server:gitolite-admin

提示報錯：

[root@manage ~]#  git clone git-server:gitolite-admin
Initialized empty Git repository in /root/gitolite-admin/.git/
Bad owner or permissions on /root/.ssh/config
fatal: The remote end hung up unexpectedly

權限不對，以下給600權限解決問題

[root@manage ~]# ll /root/.ssh/config
-rw-rw-r-- 1 root root 99 Mar 29 11:28 /root/.ssh/config
[root@manage ~]# chmod 600 /root/.ssh/config
[root@manage ~]#  git clone git-server:gitolite-admin
Initialized empty Git repository in /root/gitolite-admin/.git/
Warning: Permanently added '221.195.1.233' (RSA) to the list of known hosts.
remote: Counting objects: 6, done.
remote: Compressing objects: 100% (4/4), done.
remote: Total 6 (delta 0), reused 0 (delta 0)
Receiving objects: 100% (6/6), done.

[root@manage ~]# ll gitolite-admin/
total 8
drwxrwxr-x 2 root root 4096 Mar 29 12:00 conf
drwxrwxr-x 2 root root 4096 Mar 29 12:00 keydir

clone完後會有個新的目錄gitolite-admin，裏面有兩個文件夾conf和keydir，第一個目錄中包含的是配置文件，裏面就是記錄權限配置的地方，第二個目錄中則包含所有用戶的pub key。

[root@manage ~]# ll gitolite-admin/*
gitolite-admin/conf:
total 4
-rw-r--r-- 1 root root 77 Jul 22 15:10 gitolite.conf
gitolite-admin/keydir:
total 4
-rw-r--r-- 1 root root 393 Jul 22 15:10 git-admin.pub

[root@manage ~]# cat gitolite-admin/conf/gitolite.conf 
repo gitolite-admin
    RW+     =   admin

repo testing
RW+     =   @all

首先 gitolite-admin只有admin有讀寫權限，其他人都不能讀寫
另外一個代碼庫testing是所有人都可以訪問

2.4放置manage端機器的公鑰文件git-admin.pub到gitolite-admin/keydir 目錄下，然後提交到遠程的版本庫git-server上

[root@manage ~]# git add conf/ keydir/
[root@manage ~]# git status
[root@manage ~]# git push

在git-server 機器遠程版本庫上查看密鑰文件：
[git@git-server ~]$ cat /home/git/.ssh/authorized_keys

#gitolite start
command="/home/git/gitolite/src/gitolite-shell admin",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAzXc/2BPDIZ/3PnoXhgVEyZLdF5oiE+UuumBeOxcR2FGoGUVEaSWYOZ2zWYIk5RCzKNWb3d9Ur51l7DpQunmCUlvf4lOZ7UT68jnhAF/NNN9a6upEHBls5hpFvVp+DmqOYuVuWs+FQhShPvp70QJfsx/+gg14rw9A1/jN5GdgrrStYorNEE1Ut8/T1t9tNxsIlfwgd6pQPKpWJ11sANWx9U+DfUEAN4a0bCiZ/PQ+9aR+SJ1Y+H68pt2+iy4I8UXuhtgSqYTu5YmxsJlF3uoHypF4lOTqgiP0HYr8FNZ3KWg2ome8fUOnO2VbNvgAXafhLEfBd5zxd6YChDHwfIclvQ== root@manage
#gitolite end

此時你可以免祕鑰在manage機器上進行克隆遠程版本庫上的代碼：

[root@manage ~]# git clone git-server:gitolite-admin
Initialized empty Git repository in /tmp/gitolite-admin/.git/
remote: Counting objects: 16, done.
remote: Compressing objects: 100% (12/12), done.
remote: Total 16 (delta 2), reused 0 (delta 0)
Receiving objects: 100% (16/16), done.
Resolving deltas: 100% (2/2), done.
[root@manage ~]# ll gitolite-admin
total 8
drwxrwxr-x 2 root root 4096 Mar 30 21:57 conf
drwxrwxr-x 2 root root 4096 Mar 30 21:57 keydir

如果註釋掉[git@git-server ~]$ ll /home/git/.ssh/authorized_keys這個文件的內容，在你克隆的時候回提示讓你輸入密碼，同事即使你輸入密碼，clone遠程版本庫的代碼依舊會失敗

[root@ tmp]# git clone git-server:gitolite-admin
Initialized empty Git repository in /tmp/gitolite-admin/.git/
[email protected]'s password: 123456
fatal: 'gitolite-admin' does not appear to be a git repository
fatal: The remote end hung up unexpectedly