☰

Apache > mod_auth_dbm 合并组和用户文件

tag-icon • tag-icon apache-2.2 git
Apache > mod_auth_dbm 合并组和用户文件

git-http-backend我在CentOS 6.5 的 VPS 上创建了一个 Git 服务器，并使用htpasswd身份验证。相关部分以前看起来像这样：

  <LocationMatch ".*">
    AuthType Basic
    AuthName "Git Repositories"
    AuthUserFile /etc/gitdata/gitusers.passwd
    Require valid-user
  </LocationMatch>

这样做的缺点是所有有效用户都可以访问所有存储库。现在，我希望用户或用户组只能访问特定的存储库。研究表明，使用 Apache 可以最好地实现这一点mod_auth_dbm。因此，我创建了一个如下设置：

  ServerName git.myserver.com

  ScriptAlias / /usr/libexec/git-core/git-http-backend/
  DocumentRoot "/var/git"

  SetEnv GIT_PROJECT_ROOT /var/git
  SetEnv GIT_HTTP_EXPORT_ALL
  SetEnv REMOTE_USER=$REDIRECT_REMOTE_USER


 <Directory "/">
    AllowOverride None
    Order allow,deny
    Allow from all
    Options -Indexes +FollowSymLinks -Includes +ExecCGI

    AuthType Basic
    AuthName "Git Repositories"
    AuthDBMGroupFile /etc/gitdata/userbase
    AuthDBMUserFile /etc/gitdata/userbase
    Require group admin
  </Directory>

 <Directory "/projects">
    Allow from all
    Order allow,deny

    AuthName "Project Repository - projects"
    AuthType Basic
    Require group admin

    <Limit GET PUT POST DELETE PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
      Require group admin
    </Limit>
  </Directory>

然后我userbase使用创建了该文件htdbm，并在其中创建了一个用户，如下所示：

sudo htdbm -bt /etc/gitdata/userbase xedinunknown "mysecretpassword" "admin:Main Admin"

现在，我的userbase文件如下所示：

$ sudo htdbm -l /etc/gitdata/userbase
Dumping records from database -- /etc/gitdata/userbase
    Username                         Comment
    xedinunknown                     admin:Main Admin
Total #records : 1

一些例子，以及mod_auth_dbm 文档，让我相信在这种情况下，admin将是用户所属的组xedinunknown。但是，尝试克隆存储库时出现身份验证错误：

git clone http://[email protected]/projects
Cloning into 'projects'...
Password for 'http://[email protected]': 
fatal: Authentication failed

我必须提到，模块的文档指定可以合并组文件和用户文件，但没有说明如何合并。我是否遗漏了什么？这里有人这样做过吗？如果有，请解释一下。

谢谢！

更新 1

$ sudo httpd -v
Server version: Apache/2.2.15 (Unix)
Server built:   Aug 13 2013 17:29:28

$ sudo httpd -M
Loaded Modules:
 core_module (static)
 mpm_prefork_module (static)
 http_module (static)
 so_module (static)
 auth_basic_module (shared)
 auth_digest_module (shared)
 authn_file_module (shared)
 authn_alias_module (shared)
 authn_anon_module (shared)
 authn_dbm_module (shared)
 authn_default_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 authz_owner_module (shared)
 authz_groupfile_module (shared)
 authz_dbm_module (shared)
 authz_default_module (shared)
 ldap_module (shared)
 authnz_ldap_module (shared)
 include_module (shared)
 log_config_module (shared)
 logio_module (shared)
 env_module (shared)
 ext_filter_module (shared)
 mime_magic_module (shared)
 expires_module (shared)
 deflate_module (shared)
 headers_module (shared)
 usertrack_module (shared)
 setenvif_module (shared)
 mime_module (shared)
 dav_module (shared)
 status_module (shared)
 autoindex_module (shared)
 info_module (shared)
 dav_fs_module (shared)
 vhost_alias_module (shared)
 negotiation_module (shared)
 dir_module (shared)
 actions_module (shared)
 speling_module (shared)
 userdir_module (shared)
 alias_module (shared)
 substitute_module (shared)
 rewrite_module (shared)
 proxy_module (shared)
 proxy_balancer_module (shared)
 proxy_ftp_module (shared)
 proxy_http_module (shared)
 proxy_ajp_module (shared)
 proxy_connect_module (shared)
 cache_module (shared)
 suexec_module (shared)
 disk_cache_module (shared)
 cgi_module (shared)
 version_module (shared)
 php5_module (shared)
 ssl_module (shared)
Syntax OK

答案1

看起来，这admin可能被视为评论的一部分，而不是组。根据文档，您应该使用dbmmanage将组分配给用户。检查http://httpd.apache.org/docs/2.2/programs/dbmmanage.html。

相关内容