From f89d943fc55e7d9bf4fd197fa0e2cb6500952ce4 Mon Sep 17 00:00:00 2001
From: Matthias Lucas Jaros <jarlucmat@mailbox.org>
Date: Mon, 27 Oct 2025 10:27:47 +0100
Subject: Added banner and renamed run script to git-run

---
 src/git-run  | 45 +++++++++++++++++++++++++++++++++++++++++++++
 src/init     |  5 +++--
 src/run      | 45 ---------------------------------------------
 src/ssh.conf |  2 +-
 src/version  |  1 +
 5 files changed, 50 insertions(+), 48 deletions(-)
 create mode 100755 src/git-run
 delete mode 100755 src/run
 create mode 100644 src/version

(limited to 'src')

diff --git a/src/git-run b/src/git-run
new file mode 100755
index 0000000..68d4989
--- /dev/null
+++ b/src/git-run
@@ -0,0 +1,45 @@
+#!/usr/bin/env fish
+
+# load environment
+source (dirname (status --current-filename))/env
+
+set -l gitCommand
+set -l repoDir
+
+# redirect stdout/stderr to file, no information to potential attacker
+begin
+	# check given git command
+	# basic form is <git-command> '<path-to-repo>'
+	set -l currentUser (whoami)
+	set -l matcher (string match -r -g $_GIT_VALIDATION_REGEX -- "$argv")
+	if test (count $matcher) -ne 2
+		echo "$(date -Is): DENY bad_format user=$currentUser ip=$SSH_CONNECTION argv=$argv"
+		exit 1
+	end
+
+	# extract variables from git command
+	set gitCommand $matcher[1]
+	set -l repo $matcher[2]
+
+	# adjust repo path to /srv/repos
+	set repoDir /(string join -n '/' srv repos (string split '/' $repo))
+
+	# check if realPath is in jail under /srv/repos
+	set -l realPath (realpath $repoDir)
+	if not string match -r -q -- "/srv/repos/.*" "$realPath"
+		echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv"
+		exit 2
+	end
+
+	# check for permissions
+	if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser\$"
+		echo "$(date -Is): DENY no_permissions user=$currentUser ip=$SSH_CONNECTION argv=$argv"
+		exit 3
+	end
+
+	# info logging
+	echo "$(date -Is): ALLOW ok user=$currentUser ip=$SSH_CONNECTION argv=$argv"
+end &>>$_LOG
+
+# execute parsed git command
+/usr/bin/sudo -u git /usr/bin/git-shell -c "$gitCommand '$repoDir'"
\ No newline at end of file
diff --git a/src/init b/src/init
index 394335a..3686332 100755
--- a/src/init
+++ b/src/init
@@ -2,6 +2,7 @@
 
 # load environment
 source (dirname (status --current-filename))/env
+set VERSION (cat (dirname (status --current-filename))/version)
 
 #
 #
@@ -34,7 +35,7 @@ function createUser
 	# add user to sudo group
 	addgroup "$user" $_GIT_SUDO_GROUP
 	# unlock account to allow ssh logins
-	passwd -u "$user"
+	passwd -u "$user" &>/dev/null
 	mkdir "$HOME/.ssh"
 	echo "$key" > "$HOME/.ssh/authorized_keys"
 	chown -R $user "$HOME"
@@ -124,7 +125,7 @@ function showBanner
  |___/
 '
 	echo
-	echo Copyright Matthias Jaros 2025
+	echo Version $VERSION Copyright Matthias Jaros 2025
 	echo
 end
 
diff --git a/src/run b/src/run
deleted file mode 100755
index 51d912c..0000000
--- a/src/run
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/usr/bin/env fish
-
-# load environment
-source (dirname (status --current-filename))/env
-
-set -l gitCommand
-set -l repoDir
-
-# redirect stdout/stderr to file, no information to potential attacker
-begin
-	# check given git command
-	# basic form is <git-command> '<path-to-repo>'
-	set -l currentUser (whoami)
-	set -l matcher (string match -r -g $_GIT_VALIDATION_REGEX -- "$argv")
-	if test (count $matcher) -ne 2
-		echo "$(date -Is): DENY bad_format user=$currentUser ip=$SSH_CONNECTION argv=$argv"
-		exit 1
-	end
-
-	# extract variables from git command
-	set gitCommand $matcher[1]
-	set -l repo $matcher[2]
-
-	# adjust repo path to /srv/repos
-	set repoDir /(string join -n '/' srv repos (string split '/' $repo))
-
-	# check if realPath is in jail under /srv/repos
-	set -l realPath (realpath $repoDir)
-	if not string match -r -q -- "/srv/repos/.*" "$realPath"
-		echo "$(date -Is): DENY jail_escape user=$currentUser ip=$SSH_CONNECTION realPath=$realPath argv=$argv"
-		exit 2
-	end
-
-	# check for permissions
-	if not cat $_REPO_PERMISSIONS_FILE | grep -q -E "^$repoDir:$currentUser\$"
-		echo "$(date -Is): DENY no_permissions user=$currentUser ip=$SSH_CONNECTION argv=$argv"
-		exit 3
-	end
-
-	# info logging
-	echo "$(date -Is): ALLOW user=$currentUser ip=$SSH_CONNECTION argv=$argv"
-end &>>$_LOG
-
-# execute parsed git command
-/usr/bin/sudo -u git /usr/bin/git-shell -c "$gitCommand '$repoDir'"
\ No newline at end of file
diff --git a/src/ssh.conf b/src/ssh.conf
index 0de789c..407285d 100644
--- a/src/ssh.conf
+++ b/src/ssh.conf
@@ -18,7 +18,7 @@ SyslogFacility AUTH
 LogLevel INFO
 
 # Force run script that checks for permissions and runs sudo
-ForceCommand /usr/local/bin/run "$SSH_ORIGINAL_COMMAND"
+ForceCommand /usr/local/bin/git-run "$SSH_ORIGINAL_COMMAND"
 
 # git user has access to EVERYTHING. no login should be possible
 DenyUsers git
diff --git a/src/version b/src/version
new file mode 100644
index 0000000..9f8e9b6
--- /dev/null
+++ b/src/version
@@ -0,0 +1 @@
+1.0
\ No newline at end of file
-- 
cgit v1.3.1