Forward ssh for Git user to Git server2019 Community Moderator ElectionCalling xrandr via SSHGit config forwardingunable to connect to forwarded port over sshUnable to ssh in to machine behind routertunnelling ssh through sshSSH session through jumphost via remote port forwardingHelp with connecting to SSH server over internetSSH Remote port forwarding with multiple portsConnect to remote server through a trusted (by the server) proxy machine (using ssh tunneling or “user-space” VPN)

Redundant comparison & "if" before assignment

What does "Scientists rise up against statistical significance" mean? (Comment in Nature)

Why does AES have exactly 10 rounds for a 128-bit key, 12 for 192 bits and 14 for a 256-bit key size?

Plot of a tornado-shaped surface

What are some good ways to treat frozen vegetables such that they behave like fresh vegetables when stir frying them?

What if a revenant (monster) gains fire resistance?

Why does the Sun have different day lengths, but not the gas giants?

Why did the EU agree to delay the Brexit deadline?

15% tax on $7.5k earnings. Is that right?

Mixing PEX brands

Temporarily disable WLAN internet access for children, but allow it for adults

Do the primes contain an infinite almost arithmetic progression?

Picking the different solutions to the time independent Schrodinger eqaution

What should you do when eye contact makes your subordinate uncomfortable?

How do you respond to a colleague from another team when they're wrongly expecting that you'll help them?

Why should universal income be universal?

Mimic lecturing on blackboard, facing audience

What is the evidence for the "tyranny of the majority problem" in a direct democracy context?

Electoral considerations aside, what are potential benefits, for the US, of policy changes proposed by the tweet recognizing Golan annexation?

How to cover method return statement in Apex Class?

What exact color does ozone gas have?

Strong empirical falsification of quantum mechanics based on vacuum energy density

Angel of Condemnation - Exile creature with second ability

Biological Blimps: Propulsion



Forward ssh for Git user to Git server



2019 Community Moderator ElectionCalling xrandr via SSHGit config forwardingunable to connect to forwarded port over sshUnable to ssh in to machine behind routertunnelling ssh through sshSSH session through jumphost via remote port forwardingHelp with connecting to SSH server over internetSSH Remote port forwarding with multiple portsConnect to remote server through a trusted (by the server) proxy machine (using ssh tunneling or “user-space” VPN)










4















It is surprisingly difficult to find information on this simple problem.



Like many people we run a gitlabs/gogs server on a remote instance. Currently it listens on port 10022. We also run ssh on that instance to administer the server. It listens on port 22.



We'd like the ssh server listening on port 22 to forward connections for Git@ ONLY to the Git server on 10022.



That way when people use Git locally, they won't have to manually specify the port of our remote Git server each time.



How can we do this?










share|improve this question




























    4















    It is surprisingly difficult to find information on this simple problem.



    Like many people we run a gitlabs/gogs server on a remote instance. Currently it listens on port 10022. We also run ssh on that instance to administer the server. It listens on port 22.



    We'd like the ssh server listening on port 22 to forward connections for Git@ ONLY to the Git server on 10022.



    That way when people use Git locally, they won't have to manually specify the port of our remote Git server each time.



    How can we do this?










    share|improve this question


























      4












      4








      4








      It is surprisingly difficult to find information on this simple problem.



      Like many people we run a gitlabs/gogs server on a remote instance. Currently it listens on port 10022. We also run ssh on that instance to administer the server. It listens on port 22.



      We'd like the ssh server listening on port 22 to forward connections for Git@ ONLY to the Git server on 10022.



      That way when people use Git locally, they won't have to manually specify the port of our remote Git server each time.



      How can we do this?










      share|improve this question
















      It is surprisingly difficult to find information on this simple problem.



      Like many people we run a gitlabs/gogs server on a remote instance. Currently it listens on port 10022. We also run ssh on that instance to administer the server. It listens on port 22.



      We'd like the ssh server listening on port 22 to forward connections for Git@ ONLY to the Git server on 10022.



      That way when people use Git locally, they won't have to manually specify the port of our remote Git server each time.



      How can we do this?







      ssh git sshd openssh gitlab






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Apr 2 '17 at 11:37









      Jeff Schaller

      43.8k1161141




      43.8k1161141










      asked Feb 7 '16 at 13:36









      DMCodingDMCoding

      1315




      1315




















          3 Answers
          3






          active

          oldest

          votes


















          1














          I have never done that but maybe this does what you want:



          You can put a Match block for the user git in sshd_config which contains ForceCommand. The forced command can be an ssh login to the real server. You can use public key authentication without passphrase so the users might not even notice this.






          share|improve this answer























          • Can we not forward the user's own public key auth token? The public key authentications and the repos they allow access to are managed by the git server itself -- just like github.

            – DMCoding
            Feb 7 '16 at 13:59











          • No, it is not possible with openssh. As late as you are in Match block, you can't redirect the connection to different ssh server.

            – Jakuje
            Feb 7 '16 at 15:14


















          1














          A simpler approach would be:



          Just tell your users to add an alias for your git-server to the ~/.ssh/config. Then they have the same convenience as with github and you don't have to do some weird redirections on the server side.



          For example:



          # put into ~/.ssh/config
          Host mygitlab
          Hostname git.example.org
          Port 10022


          Then your users can just clone etc. like this:



          $ git clone mygitlab:someuser/somerepo.git





          share|improve this answer

























          • They are users, not administrators so that would not in any way be simpler. I really dont see how this is a weird idea -- what do github, bitbucket, etc. do? You're telling me they don't use SSH to administer their server fleet just because that port happens to be taken by their git software?

            – DMCoding
            Feb 7 '16 at 21:49












          • @DanielJames probably they use a different port for admin?

            – nafg
            Mar 31 '17 at 5:53











          • @nafg, doubtful when there's a more elegant way. You have a list of git users and a list of shell users. Shell users are allowed to use their default shell, git users are forced to use a special git shell binary which only allows git commands. Not difficult, not complicated, not hard to understand. Gitlabs do it (gitlab.com/gitlab-org/gitlab-shell) I'd bet money github does as well.

            – DMCoding
            Mar 31 '17 at 18:16


















          0














          the solution lies in the gitlab GUI: just click on the clone button, and paste in the command line.



          $ git clone ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git


          and you can verify everything is correct with:



          $ git remote -v
          origin ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git (fetch)
          origin ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git (push)





          share|improve this answer










          New contributor




          MaxiReglisse is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
          Check out our Code of Conduct.




















          • How does this address the question?

            – RalfFriedl
            yesterday










          Your Answer








          StackExchange.ready(function()
          var channelOptions =
          tags: "".split(" "),
          id: "106"
          ;
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function()
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled)
          StackExchange.using("snippets", function()
          createEditor();
          );

          else
          createEditor();

          );

          function createEditor()
          StackExchange.prepareEditor(
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: false,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: null,
          bindNavPrevention: true,
          postfix: "",
          imageUploader:
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          ,
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          );



          );













          draft saved

          draft discarded


















          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f260564%2fforward-ssh-for-git-user-to-git-server%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown

























          3 Answers
          3






          active

          oldest

          votes








          3 Answers
          3






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes









          1














          I have never done that but maybe this does what you want:



          You can put a Match block for the user git in sshd_config which contains ForceCommand. The forced command can be an ssh login to the real server. You can use public key authentication without passphrase so the users might not even notice this.






          share|improve this answer























          • Can we not forward the user's own public key auth token? The public key authentications and the repos they allow access to are managed by the git server itself -- just like github.

            – DMCoding
            Feb 7 '16 at 13:59











          • No, it is not possible with openssh. As late as you are in Match block, you can't redirect the connection to different ssh server.

            – Jakuje
            Feb 7 '16 at 15:14















          1














          I have never done that but maybe this does what you want:



          You can put a Match block for the user git in sshd_config which contains ForceCommand. The forced command can be an ssh login to the real server. You can use public key authentication without passphrase so the users might not even notice this.






          share|improve this answer























          • Can we not forward the user's own public key auth token? The public key authentications and the repos they allow access to are managed by the git server itself -- just like github.

            – DMCoding
            Feb 7 '16 at 13:59











          • No, it is not possible with openssh. As late as you are in Match block, you can't redirect the connection to different ssh server.

            – Jakuje
            Feb 7 '16 at 15:14













          1












          1








          1







          I have never done that but maybe this does what you want:



          You can put a Match block for the user git in sshd_config which contains ForceCommand. The forced command can be an ssh login to the real server. You can use public key authentication without passphrase so the users might not even notice this.






          share|improve this answer













          I have never done that but maybe this does what you want:



          You can put a Match block for the user git in sshd_config which contains ForceCommand. The forced command can be an ssh login to the real server. You can use public key authentication without passphrase so the users might not even notice this.







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered Feb 7 '16 at 13:43









          Hauke LagingHauke Laging

          57.5k1287136




          57.5k1287136












          • Can we not forward the user's own public key auth token? The public key authentications and the repos they allow access to are managed by the git server itself -- just like github.

            – DMCoding
            Feb 7 '16 at 13:59











          • No, it is not possible with openssh. As late as you are in Match block, you can't redirect the connection to different ssh server.

            – Jakuje
            Feb 7 '16 at 15:14

















          • Can we not forward the user's own public key auth token? The public key authentications and the repos they allow access to are managed by the git server itself -- just like github.

            – DMCoding
            Feb 7 '16 at 13:59











          • No, it is not possible with openssh. As late as you are in Match block, you can't redirect the connection to different ssh server.

            – Jakuje
            Feb 7 '16 at 15:14
















          Can we not forward the user's own public key auth token? The public key authentications and the repos they allow access to are managed by the git server itself -- just like github.

          – DMCoding
          Feb 7 '16 at 13:59





          Can we not forward the user's own public key auth token? The public key authentications and the repos they allow access to are managed by the git server itself -- just like github.

          – DMCoding
          Feb 7 '16 at 13:59













          No, it is not possible with openssh. As late as you are in Match block, you can't redirect the connection to different ssh server.

          – Jakuje
          Feb 7 '16 at 15:14





          No, it is not possible with openssh. As late as you are in Match block, you can't redirect the connection to different ssh server.

          – Jakuje
          Feb 7 '16 at 15:14













          1














          A simpler approach would be:



          Just tell your users to add an alias for your git-server to the ~/.ssh/config. Then they have the same convenience as with github and you don't have to do some weird redirections on the server side.



          For example:



          # put into ~/.ssh/config
          Host mygitlab
          Hostname git.example.org
          Port 10022


          Then your users can just clone etc. like this:



          $ git clone mygitlab:someuser/somerepo.git





          share|improve this answer

























          • They are users, not administrators so that would not in any way be simpler. I really dont see how this is a weird idea -- what do github, bitbucket, etc. do? You're telling me they don't use SSH to administer their server fleet just because that port happens to be taken by their git software?

            – DMCoding
            Feb 7 '16 at 21:49












          • @DanielJames probably they use a different port for admin?

            – nafg
            Mar 31 '17 at 5:53











          • @nafg, doubtful when there's a more elegant way. You have a list of git users and a list of shell users. Shell users are allowed to use their default shell, git users are forced to use a special git shell binary which only allows git commands. Not difficult, not complicated, not hard to understand. Gitlabs do it (gitlab.com/gitlab-org/gitlab-shell) I'd bet money github does as well.

            – DMCoding
            Mar 31 '17 at 18:16















          1














          A simpler approach would be:



          Just tell your users to add an alias for your git-server to the ~/.ssh/config. Then they have the same convenience as with github and you don't have to do some weird redirections on the server side.



          For example:



          # put into ~/.ssh/config
          Host mygitlab
          Hostname git.example.org
          Port 10022


          Then your users can just clone etc. like this:



          $ git clone mygitlab:someuser/somerepo.git





          share|improve this answer

























          • They are users, not administrators so that would not in any way be simpler. I really dont see how this is a weird idea -- what do github, bitbucket, etc. do? You're telling me they don't use SSH to administer their server fleet just because that port happens to be taken by their git software?

            – DMCoding
            Feb 7 '16 at 21:49












          • @DanielJames probably they use a different port for admin?

            – nafg
            Mar 31 '17 at 5:53











          • @nafg, doubtful when there's a more elegant way. You have a list of git users and a list of shell users. Shell users are allowed to use their default shell, git users are forced to use a special git shell binary which only allows git commands. Not difficult, not complicated, not hard to understand. Gitlabs do it (gitlab.com/gitlab-org/gitlab-shell) I'd bet money github does as well.

            – DMCoding
            Mar 31 '17 at 18:16













          1












          1








          1







          A simpler approach would be:



          Just tell your users to add an alias for your git-server to the ~/.ssh/config. Then they have the same convenience as with github and you don't have to do some weird redirections on the server side.



          For example:



          # put into ~/.ssh/config
          Host mygitlab
          Hostname git.example.org
          Port 10022


          Then your users can just clone etc. like this:



          $ git clone mygitlab:someuser/somerepo.git





          share|improve this answer















          A simpler approach would be:



          Just tell your users to add an alias for your git-server to the ~/.ssh/config. Then they have the same convenience as with github and you don't have to do some weird redirections on the server side.



          For example:



          # put into ~/.ssh/config
          Host mygitlab
          Hostname git.example.org
          Port 10022


          Then your users can just clone etc. like this:



          $ git clone mygitlab:someuser/somerepo.git






          share|improve this answer














          share|improve this answer



          share|improve this answer








          edited Feb 7 '16 at 14:21

























          answered Feb 7 '16 at 14:09









          maxschlepzigmaxschlepzig

          34.5k33140214




          34.5k33140214












          • They are users, not administrators so that would not in any way be simpler. I really dont see how this is a weird idea -- what do github, bitbucket, etc. do? You're telling me they don't use SSH to administer their server fleet just because that port happens to be taken by their git software?

            – DMCoding
            Feb 7 '16 at 21:49












          • @DanielJames probably they use a different port for admin?

            – nafg
            Mar 31 '17 at 5:53











          • @nafg, doubtful when there's a more elegant way. You have a list of git users and a list of shell users. Shell users are allowed to use their default shell, git users are forced to use a special git shell binary which only allows git commands. Not difficult, not complicated, not hard to understand. Gitlabs do it (gitlab.com/gitlab-org/gitlab-shell) I'd bet money github does as well.

            – DMCoding
            Mar 31 '17 at 18:16

















          • They are users, not administrators so that would not in any way be simpler. I really dont see how this is a weird idea -- what do github, bitbucket, etc. do? You're telling me they don't use SSH to administer their server fleet just because that port happens to be taken by their git software?

            – DMCoding
            Feb 7 '16 at 21:49












          • @DanielJames probably they use a different port for admin?

            – nafg
            Mar 31 '17 at 5:53











          • @nafg, doubtful when there's a more elegant way. You have a list of git users and a list of shell users. Shell users are allowed to use their default shell, git users are forced to use a special git shell binary which only allows git commands. Not difficult, not complicated, not hard to understand. Gitlabs do it (gitlab.com/gitlab-org/gitlab-shell) I'd bet money github does as well.

            – DMCoding
            Mar 31 '17 at 18:16
















          They are users, not administrators so that would not in any way be simpler. I really dont see how this is a weird idea -- what do github, bitbucket, etc. do? You're telling me they don't use SSH to administer their server fleet just because that port happens to be taken by their git software?

          – DMCoding
          Feb 7 '16 at 21:49






          They are users, not administrators so that would not in any way be simpler. I really dont see how this is a weird idea -- what do github, bitbucket, etc. do? You're telling me they don't use SSH to administer their server fleet just because that port happens to be taken by their git software?

          – DMCoding
          Feb 7 '16 at 21:49














          @DanielJames probably they use a different port for admin?

          – nafg
          Mar 31 '17 at 5:53





          @DanielJames probably they use a different port for admin?

          – nafg
          Mar 31 '17 at 5:53













          @nafg, doubtful when there's a more elegant way. You have a list of git users and a list of shell users. Shell users are allowed to use their default shell, git users are forced to use a special git shell binary which only allows git commands. Not difficult, not complicated, not hard to understand. Gitlabs do it (gitlab.com/gitlab-org/gitlab-shell) I'd bet money github does as well.

          – DMCoding
          Mar 31 '17 at 18:16





          @nafg, doubtful when there's a more elegant way. You have a list of git users and a list of shell users. Shell users are allowed to use their default shell, git users are forced to use a special git shell binary which only allows git commands. Not difficult, not complicated, not hard to understand. Gitlabs do it (gitlab.com/gitlab-org/gitlab-shell) I'd bet money github does as well.

          – DMCoding
          Mar 31 '17 at 18:16











          0














          the solution lies in the gitlab GUI: just click on the clone button, and paste in the command line.



          $ git clone ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git


          and you can verify everything is correct with:



          $ git remote -v
          origin ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git (fetch)
          origin ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git (push)





          share|improve this answer










          New contributor




          MaxiReglisse is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
          Check out our Code of Conduct.




















          • How does this address the question?

            – RalfFriedl
            yesterday















          0














          the solution lies in the gitlab GUI: just click on the clone button, and paste in the command line.



          $ git clone ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git


          and you can verify everything is correct with:



          $ git remote -v
          origin ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git (fetch)
          origin ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git (push)





          share|improve this answer










          New contributor




          MaxiReglisse is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
          Check out our Code of Conduct.




















          • How does this address the question?

            – RalfFriedl
            yesterday













          0












          0








          0







          the solution lies in the gitlab GUI: just click on the clone button, and paste in the command line.



          $ git clone ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git


          and you can verify everything is correct with:



          $ git remote -v
          origin ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git (fetch)
          origin ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git (push)





          share|improve this answer










          New contributor




          MaxiReglisse is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
          Check out our Code of Conduct.










          the solution lies in the gitlab GUI: just click on the clone button, and paste in the command line.



          $ git clone ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git


          and you can verify everything is correct with:



          $ git remote -v
          origin ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git (fetch)
          origin ssh://git@gitlab.mydomain.org:10022/mygroup/myproject.git (push)






          share|improve this answer










          New contributor




          MaxiReglisse is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
          Check out our Code of Conduct.









          share|improve this answer



          share|improve this answer








          edited 13 hours ago





















          New contributor




          MaxiReglisse is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
          Check out our Code of Conduct.









          answered yesterday









          MaxiReglisseMaxiReglisse

          1012




          1012




          New contributor




          MaxiReglisse is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
          Check out our Code of Conduct.





          New contributor





          MaxiReglisse is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
          Check out our Code of Conduct.






          MaxiReglisse is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
          Check out our Code of Conduct.












          • How does this address the question?

            – RalfFriedl
            yesterday

















          • How does this address the question?

            – RalfFriedl
            yesterday
















          How does this address the question?

          – RalfFriedl
          yesterday





          How does this address the question?

          – RalfFriedl
          yesterday

















          draft saved

          draft discarded
















































          Thanks for contributing an answer to Unix & Linux Stack Exchange!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid


          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.

          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f260564%2fforward-ssh-for-git-user-to-git-server%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          Popular posts from this blog

          getting Checkpoint VPN SSL Network Extender working in the command lineHow to connect to CheckPoint VPN on Ubuntu 18.04LTS?Will the Linux ( red-hat ) Open VPNC Client connect to checkpoint or nortel VPN gateways?VPN client for linux machine + support checkpoint gatewayVPN SSL Network Extender in FirefoxLinux Checkpoint SNX tool configuration issuesCheck Point - Connect under Linux - snx + OTPSNX VPN Ububuntu 18.XXUsing Checkpoint VPN SSL Network Extender CLI with certificateVPN with network manager (nm-applet) is not workingWill the Linux ( red-hat ) Open VPNC Client connect to checkpoint or nortel VPN gateways?VPN client for linux machine + support checkpoint gatewayImport VPN config files to NetworkManager from command lineTrouble connecting to VPN using network-manager, while command line worksStart a VPN connection with PPTP protocol on command linestarting a docker service daemon breaks the vpn networkCan't connect to vpn with Network-managerVPN SSL Network Extender in FirefoxUsing Checkpoint VPN SSL Network Extender CLI with certificate

          Cannot Extend partition with GParted The 2019 Stack Overflow Developer Survey Results Are In Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) 2019 Community Moderator Election ResultsCan't increase partition size with GParted?GParted doesn't recognize the unallocated space after my current partitionWhat is the best way to add unallocated space located before to Ubuntu 12.04 partition with GParted live?I can't figure out how to extend my Arch home partition into free spaceGparted Linux Mint 18.1 issueTrying to extend but swap partition is showing as Unknown in Gparted, shows proper from fdiskRearrange partitions in gparted to extend a partitionUnable to extend partition even though unallocated space is next to it using GPartedAllocate free space to root partitiongparted: how to merge unallocated space with a partition

          Marilyn Monroe Ny fiainany manokana | Jereo koa | Meny fitetezanafanitarana azy.