Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to make an ssh key (passwordless) that I can hand out to remote users so they can do an hg pull or hg clone of my repositories. I've gotten as far as making an ssh key that uses only the command /usr/bin/hg but that doesn't work when using the clone or pull commands, because the command string doesn't match whatever the remote command call mercurial uses internally.

Is it possible to get the commands mercurial executes on the remote host when you do a:

hg clone ssh://user@host//path-to-repo
hg pull ssh://user@host//path-to-repo

And can I reliably come up with a couple command strings that will cover all my bases? If they were going to pull with a specific revision, would that use a different remote command through the ssh?

share|improve this question
up vote 5 down vote accepted

Mercurial comes with handy script already setup for exactly this sort of restricted access. THe script is probably already on your server and is named hg-ssh, but you can also find it here:

To use it just put a line like this in your /home/user/.ssh/authorized_keys file:

command="hg-ssh path/to/repo1 /path/to/repo2 ~/repo3 ~user/repo4" ssh-dss ...

that'll make sure that people w/ that key can only use mercurial (not a shell) and only on the repos you list.

share|improve this answer

So if you don't want to let them push, then I recommend that use --read-only option for hg-ssh command in addition to Ry4an's answer.

share|improve this answer

Sign up to bitbucket and clone your repository to it - you get one private repository and 150MB free.

Then get your users to sign up for bitbucket, and give them read-only permission. They can then access the repository using https, or ssh if they upload their public key.

Alternatively, you could set up a second, shadow bitbucket account, give it read-only permission, then upload a public key and share the private key with your users. They can then clone over ssh using the shadow account's public key, without signing up individually.

share|improve this answer
This has been changed to - any number of private repositories. – viraptor Jan 27 '11 at 11:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .