Git身份验证推送过Apache

Question

I have several Git repositories. All of them can be accessed through apache server and R/W access is given to all. But some repository should have authenticated push to it. I have done something like this

<LocationMatch "^/.*/git-receive-pack$">
    AuthType Basic
    AuthName "Git Access"
    AuthBasicProvider file
    # Password file created with htpasswd
    AuthUserFile /sample/password
    Require valid-user
</LocationMatch>

But it is asking for username and password for all the repositories. I want to enable it for only few repositories.

Answer 1

Some background

The idea is that when pushing via HTTP[S], Git performs requests like this

http://user@server/git/foo.git/info/refs?service=git-receive-pack

The part of this URI which <Location> or <LocationMatch> directives consider when matching is

/git/foo.git/info/refs?service=git-receive-pack

It can be broken down into several parts:

1. The common prefix, including the name of the repository:

    /git/foo.git 

   That's what you directly specify in the repository's URI when telling about it to Git, like when doing git clone http://user@server/git/foo.git .

2. The technical bits, telling server-side Git what do you want from the request:

    /info/refs?service=git-receive-pack 

   This part is added by the client-side Git, and you have no control over it.

How to fix the problem at hand

The .* bit in your directive matches zero or more any characters, so it obviously matches anything in your Git URIs.

You need to refine this pattern to somehow refer to only the repos you want the push restriction to be applied to. And also keep in mind that if you're using a common prefix (like that /git/ in my examples above) it will have to be matched as well.

Now it's about writing a proper regular expression.

One approach is to specify them directly—using the so-called alterations—like in

<LocationMatch "^/git/(repo1|repo2|repo3)/.*/git-receive-pack$">

while another is to move all the repos requiring protection under a common directory, say, priv , and use something like

<LocationMatch "^/git/priv/.*/git-receive-pack$">

The latter approach does not require you updating the Apache's configuration and reloading it when you add another repository requiring authenticated pushes: just drop it in a directory mapped by that /priv prefix.

Of course, exact parts of that URI specification depends on the rest of your configuration (like whether to use that ^/git/ prefix of not etc).