SCM Hosting-SSH

Configuring Git/SVN/Hg to use Allura auth via LDAP and ssh

The following instructions will use a chroot, a custom FUSE driver, and LDAP. Once completed, an ssh-based configuration of Git, SVN, or Hg that has repos in the chroot directory will authenticate the users against LDAP and authorize via an Allura API. Allura will be configured to authenticate against LDAP as well.

Note

The previous git & svn configuration instructions are not ssh-based, so will not work with this configuration. You’ll have to reconfigure git & svn to use ssh:// instead of http or svn protocols.

We assume you are using a version of Ubuntu with support for schroot and debootstrap. We will use a chroot jail to allow users to access their repositories via ssh.

Install a chroot environment

These instructions are based on the documentation in Debootstrap Chroot. and OpenLDAPServer.

Install debootstrap and schroot: apt-get install debootstrap schroot

Append the following text to the file /etc/schroot/schroot.conf

[scm]
description=Ubuntu Chroot for SCM Hosting
type=directory
directory=/var/chroots/scm
script-config=scm/config

Create a directory /etc/schroot/scm and populate it with some files:

# mkdir /etc/schroot/scm
# cat > /etc/schroot/scm/config <<EOF
FSTAB="/etc/schroot/scm/fstab"
COPYFILES="/etc/schroot/scm/copyfiles"
NSSDATABASES="/etc/schroot/scm/nssdatabases"
EOF
# cat > /etc/schroot/scm/fstab <<EOF
/proc               /proc           none    rw,rbind        0       0
/sys                /sys            none    rw,rbind        0       0
/dev            /dev            none    rw,rbind        0       0
/tmp                /tmp            none    rw,bind         0       0
EOF
# cat > /etc/schroot/scm/copyfiles <<EOF
/etc/resolv.conf
EOF
# cat > /etc/schroot/scm/nssdatabases <<EOF
services
protocols
networks
hosts
EOF

Create a directory /var/chroots/scm and create the bootstrap environment. (You may substitute a mirror from the ubuntu mirror list for archive.ubuntu.com)

$ sudo mkdir -p /var/chroots/scm
$ sudo debootstrap --variant=buildd --arch amd64 --components=main,universe --include=git,mercurial,subversion,openssh-server,slapd,ldap-utils,ldap-auth-client,curl maverick /var/chroots/scm http://archive.ubuntu.com/ubuntu/

Test that the chroot is installed by entering it:

# schroot -c scm -u root
(scm) # logout

Configure OpenLDAP in the Chroot

Copy the ldap-setup script into the chroot environment:

$ sudo cp Allura/ldap-setup.py Allura/ldap-userconfig.py /var/chroots/scm
$ sudo chmod +x /var/chroots/scm/ldap-*.py

Log in to the chroot environment:

# schroot -c scm -u root

Run the setup script, following the prompts:

(scm) # python /ldap-setup.py

In particular, you will need to answer the following questions (substitute your custom suffix if you are not using dc=localdomain):

  • Should debconf manage LDAP configuration? yes

  • LDAP server Uniform Resource Identifier: ldapi:///

  • Distinguished name of the search base: dc=localdomain

  • LDAP version to use: 1 (version 3)

  • Make local root Database admin: yes

  • Does the LDAP database require login? no

  • LDAP account for root: cn=admin,dc=localdomain

  • LDAP root account password: empty

  • Local crypt to use when changing passwords: 2 (crypt)

  • PAM profiles to enable: 2

Update the chroot ssh configuration

Update the file /var/chroot/scm/etc/ssh/sshd_config, changing the port directive:

# Port 22
Port 8022

Setup the Custom FUSE Driver

Copy the accessfs script into the chroot environment:

$ sudo cp fuse/accessfs.py /var/chroots/scm

Configure allura to point to the chrooted scm environment:

$ sudo ln -s /var/chroots/scm /srv/git
$ sudo ln -s /var/chroots/scm /srv/hg
$ sudo ln -s /var/chroots/scm /srv/svn

Log in to the chroot environment & install packages:

# schroot -c scm -u root
(scm) # apt-get install python-fuse

Create the SCM directories:

(scm) # mkdir /scm /scm-repo

Mount the FUSE filesystem:

(scm) # python /accessfs.py /scm-repo -o allow_other -s -o root=/scm

Start the SSH daemon:

(scm) # /etc/init.d/ssh start

Configure Allura to Use the LDAP Server

Set the following values in your .ini file:

auth.method = ldap

auth.ldap.server = ldap://localhost
auth.ldap.suffix = ou=people,dc=localdomain
auth.ldap.admin_dn = cn=admin,dc=localdomain
auth.ldap.admin_password = secret