git via ssh - (maybe) require a shell about ansible-role-gitea HOT 7 CLOSED

Interesting, I will try to repro on a vanilla instance over the weekend, thanks for reporting it

from ansible-role-gitea.

So I tried to repro, I spinned a vanilla GCP instance and ran the playbook, I was able to pull/push to the repos created over SSH like I do on my "production" personal instance without any issue.

root tmp ~ # cat /etc/debian_version 
9.7
root tmp ~ # grep gitea /etc/passwd
gitea:x:1001:1002:Gitea user:/var/lib/gitea:/bin/false
root tmp ~ # 

The gitea process is running as the user it should:

gitea    29171  0.1 16.5 622528 100576 ?       Ssl  11:42   0:01 /usr/local/bin/gitea web -c /etc/gitea/gitea.ini

Which distro are you using ?

from ansible-role-gitea.

Also if the mitigation is as simple as giving a shell to the gitea user, you can do a PR if you want to optionally give a shell to the user that's not /bin/false but I'd rather have it disabled by default for security reasons.

from ansible-role-gitea.

Hi, sorry for the delay. I was a little busy...

The user for gitea is gitea:

 $ ps auxw  | grep gitea
debian     342  0.0  0.0  12716   940 pts/0    S+   10:53   0:00 grep --color=auto gitea
gitea    18434  0.0  2.1 829288 88832 ?        Ssl  Mar28   7:26 /usr/local/bin/gitea web -c /etc/gitea/gitea.ini

I am running debian too:

 $ cat /etc/debian_version 
9.8
 $ grep gitea /etc/passwd
gitea:x:1003:1004:Gitea user:/var/lib/gitea:/bin/bash

and the issue is still present.

I will make a pull request soon™ with the option to change /bin/false to something else.

from ansible-role-gitea.

Same issue here with debian_version 10.2, Putty tells me that
Server refused to allocate pty when shell is set to /bin/false

from ansible-role-gitea.

Same issue here with debian_version 10.2, Putty tells me that
Server refused to allocate pty when shell is set to /bin/false

My work around is this option in my ansible vars:

gitea_shell: "/bin/bash"

from ansible-role-gitea.

from the gitea docs onto this topic:
(https://docs.gitea.io/en-us/faq/#ssh-issues)
Make sure that the git system user has a usable shell set
...this is true at least for the systems' ssh-server

from ansible-role-gitea.