hg-admin-tools version 0.1

A set of tools for managing authorization and access control for

ssh-based Hg repositories

Paul Crowley, paul@lshift.net, 2008-04-15

This software may be used and distributed according to the terms

of the GNU General Public License, incorporated herein by reference.

INSTRUCTIONS FOR USE:

This is only one setup - it can be tweaked in many ways, and is as specific as it is only in the interests of brevity.

You, and all users of your Hg repository, will need SSH public key authentication set up, preferably working with ssh-agent so you don't have to type in your passphrase all the time.  I assume you've done that in what follows, so if you've done something different you'll need to change it appropriately.

Create a user called "hg" on the machine where the repository will live.  I used the command

sudo adduser --system --shell /bin/sh --group --disabled-password --gecos "Mercural repository" hg

Now create a basic access control setup.  

   cd

   mkdir hg

   cd hg

   hg clone ssh://hg.opensource.lshift.net/hg-admin-tools hg-admin-tools

   mkdir -p hgadmin/keys/admin

   cd hgadmin

   ssh-add -L > keys/admin/myname

   echo "init admin/* *" > hg-ssh-access.conf

   hg init .

   hg add

   hg commit -m "Initial configuration"

You can use whatever you want in place of "myname" and indeed "admin".  The files in ~/hg must be readable by the hg user.  Issue these commands to become the hg user and set up the repository

   sudo -u hg -s

   cd ~hg

   mkdir admin repos

   hg clone ~/hg/hg-admin-tools admin/hg-admin-tools

   hg clone ~/hg/hgadmin repos/hgadmin

   cp admin/hg-admin-tools/hgadmin-hgrc repos/hgadmin/.hg/hgrc

   cp admin/hg-admin-tools/hg-ssh-wrapper hg-ssh-wrapper

   cd repos/hgadmin

   ../../admin/hg-admin-tools/refresh-auth

    exit

You should now have SSH access to this repository and full control, which you can test like so:

   cd ~/hg/hgadmin

   echo "[paths]" >> .hg/hgrc

   echo "default = ssh://hg@localhost/hgadmin"  >> .hg/hgrc

   hg pull

   hg push

These attempts to push and pull should report no new changes but otherwise work.

You can now add other users by putting their keys in an appropriate subdirectory of the "keys" directory, and control their access by editing hg-ssh-access.conf.  Changes will take effect as soon as you push them to the remote ssh server.

hg-ssh-access.conf has the following syntax:

<rule> <keypattern> <repositorypattern>

The "rule" is either "init", "allow", or "deny".  "keypattern" is a glob pattern matched against the name of the key used - for example, in our initial setup "admin/myname" matches "admin/*".  "repositorypattern" is a pattern matched againt the repository name - so "hgadmin" matches "*".  Only boring characters are allowed in patterns and key and repository names - see the source for details.  Blank lines and lines that start with "#" are ignored.