mjhjmtu

I have setup a git server, by creating a user "git" and then creating a local repository in the git user's directory.

The git server works great, I can pull, push, etc. I allowed users to interact with the git repo by adding their public keys to to the

 .ssh/authorized_keys

file. I have disabled password based logins. But the problem is that these users can login to the server via ssh since their keys are on the authorized keys list. Okay, the permissions are set to be pretty restricted for the git user, but still, I would prefer it if there was no way for git to login directly.

Is there a way to disable logins for the "git" user, but maintain the ability for the git user to accept pushes and pull through git/ssh?

I'm not convinced that having all your users log in as the "git" user is the best idea from a security standpoint, but it's certainly possible to do what you want through the ForceCommand configuration option. For example, to only let the user named "git" run the "git" command, you'd add the following to your /etc/ssh/sshd_config file:

Match User git
 ForceCommand /usr/bin/git
 AllowTCPForwarding no
 X11Forwarding no

Read the sshd_config man page and adjust as needed for your specific situation.

If you install gitlab-ce it explicitly states that a non-standard user-level ssh config can cause weird breakage and it wants to fix it.

What gitlab-ce does do though is that when adding a key via the web interface, it adds some config info at the same time -

# cat ~git/.ssh/authorized_keys
command="/opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell key-1",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AA...restofkeysnip!

Note the git user has no ~/.bashrc or ~/.profile or other dot files, and the shell is set to be /bin/sh, and there is no modification done to the sshd_config.

You can use git-shell to restrict access to SSH user accounts. From the documentation page:

This is a login shell for SSH accounts to provide restricted Git
access. It permits execution only of server-side Git commands
implementing the pull/push functionality, plus custom commands present
in a subdirectory named git-shell-commands in the user’s home
directory.

git-shell is non-interactive by default. Setting a user's default shell to git-shell will allow you to prevent users from interactively logging into your server, while keeping the functionality of git intact. Some level of customization is possible, which is documented on the same page, under the 'EXAMPLES' section.

git-shell should be installed along with git at /usr/bin/git-shell. You can set this as a user's default shell using usermod:

usermod -s /usr/bin/git-shell username