0x01 前言

GitHub的免费代码托管服务是不允许将代码设为私有的,当然付费的费用也不贵,但因为众所周知的原因,访问GitHub的网络速度太慢了。

为了能在家里也能方便地使用git管理代码,那就配置一个git服务吧。

0x02 准备

我们只需要在系统中安装git就好了,非常方便:

[[email protected] ~]# yum install git
Loaded plugins: fastestmirror
centos7-base                                                                                                                                                                         | 2.9 kB  00:00:00     
centos7-updates                                                                                                                                                                      | 2.9 kB  00:00:00     
centos7.3.1611-base                                                                                                                                                                  | 2.9 kB  00:00:00     
centos7.3.1611-updates                                                                                                                                                               | 2.9 kB  00:00:00     
epel-home                                                                                                                                                                            | 2.9 kB  00:00:00     
Determining fastest mirrors
Package git-1.8.3.1-6.el7_2.1.x86_64 already installed and latest version
Nothing to do

0x03 用户

我使用SSH为git提供认证、加密,所以先添加相关的用户与用户组:

#添加用户组
[[email protected] ~]# groupadd gituser1

#添加用户
[[email protected] ~]# useradd gituser1 -g gituser1

登入到gituser1用户,并创建SSH密钥:

#用gituser1用户登陆
[[email protected] ~]# su gituser1

#返回用户根目录
[[email protected] root]$ cd

#创建SSH密钥对
[[email protected] ~]$ ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.

#回车即可
Enter file in which to save the key (/home/gituser1/.ssh/id_rsa): 
Created directory '/home/gituser1/.ssh'.

#请务必输入密码
Enter passphrase (empty for no passphrase): 

#再次确认密码
Enter same passphrase again: 

Your identification has been saved in /home/gituser1/.ssh/id_rsa.
Your public key has been saved in /home/gituser1/.ssh/id_rsa.pub.
The key fingerprint is:
70:c8:d2:a7:a2:5c:a8:65:70:98:14:04:9b:96:5a:65 [email protected]
The key's randomart image is:
+--[ RSA 4096]----+
|++. E            |
|.=.o o .         |
|*oo . = o        |
|o+ . . =         |
|. + o . S        |
| = o .           |
|. o              |
|                 |
|                 |
+-----------------+

然后将文件id_rsa.pub重命名为authorized_keys:

[[email protected] ~]$ mv .ssh/id_rsa.pub .ssh/authorized_keys

将私钥保存在本地,以便稍后使用:

[[email protected] ~]$ cat .ssh/id_rsa

返回到root用户,修改ssh配置文件:

#退出gituser1,返回到root用户
[[email protected] ~]$ exit 
exit

#打开SSH配置文件进行修改
[[email protected] ~]# vim /etc/ssh/sshd_config

#将以下两行内容取消注释
RSAAuthentication yes
PubkeyAuthentication yes

#重启SSH服务
[[email protected] ~]# systemctl restart sshd

然后在另一台机子上测试用户与SSH的配置是否有效。将刚才的私钥保存到另一台机子上并修改权限:

#将私钥保存在文件中
[[email protected] ~]# vim web-test2.t.com.key

#将私钥的权限设为400
[[email protected] ~]# chmod 400 web-test2.t.com.key

然后通过以下命令测试SSH是否有效:

#使用密钥登陆
[[email protected] ~]# ssh [email protected] -i web-test2.t.com.key 
The authenticity of host '10.1.1.111 (10.1.1.111)' can't be established.
ECDSA key fingerprint is 26:d9:49:ad:dc:bb:da:88:9d:21:37:ba:ae:e7:c1:f0.

#首次连接询问是否接受指纹,输入y即可
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.1.1.111' (ECDSA) to the list of known hosts.

#输入私钥密码
Enter passphrase for key 'web-test2.t.com.key': 

#登陆成功
Last login: Sun Mar 12 01:19:41 2017
[[email protected] ~]$

确认一切正常后退出该账户,然后通过以下命令将私钥使用ssh-agent托管:

#退出gituser1用户
[[email protected] ~]$ exit 
logout
Connection to 10.1.1.111 closed.

#添加私钥到ssh-agent
[[email protected] ~]# ssh-add web-test2.t.com.key 

#输入私钥密码
Enter passphrase for web-test2.t.com.key: 

#添加成功
Identity added: web-test2.t.com.key (web-test2.t.com.key)

如果遇到以下错误,是因为ssh-agent服务还没启动,手动启动即可:

#尝试添加私钥到ssh-agent
[[email protected] ~]# ssh-add web-test2.t.com.key 

#遇到错误,添加失败
Could not open a connection to your authentication agent.

#手动启动ssh-agent
[[email protected] ~]# eval `ssh-agent -s`
Agent pid 1040

最后再次尝试登入gituser1用户,但这次不再需要手动指定私钥路径了:

[[email protected] ~]# ssh [email protected]
Last login: Sun Mar 12 01:31:33 2017 from web-t2.t.com
[[email protected] ~]$

0x04 git

完成用户的配置,接下来配置git仓库。首先建立一个用于存储git仓库的目录:

[[email protected] ~]# mkdir /usr/local/git_home

创建一个空的git仓库:

[[email protected] ~]# git init --bare /usr/local/git_home/test_git_1.git
Initialized empty Git repository in /usr/local/git_home/test_git_1.git/

修正权限:

[[email protected] ~]# chown -R gituser1:gituser1 /usr/local/git_home/test_git_1.git/

这样就完成了git服务器的配置。

0x05 使用

我们会到另一台机子上,通过以下命令即可clone git仓库:

[[email protected] ~]# git clone [email protected]:/usr/local/git_home/test_git_1.git
Cloning into 'test_git_1.git'...
warning: You appear to have cloned an empty repository.

因为这是刚创建的git仓库,所以里面没有文件,我们可以忽略上面的警告信息。我们来touch一个文件并push到master中:

#进入git仓库目录
[[email protected] ~]# cd test_git_1.git/

#touch一个文件
[[email protected] test_git_1.git]# touch 1.txt

#添加所有文件到git中
[[email protected] test_git_1.git]# git add *

#commit修改
[[email protected] test_git_1.git]# git commit -m "commit test 1"
[master (root-commit) eb29488] commit test 1
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 1.txt

#push变更到master分支
[[email protected] test_git_1.git]# git push origin master
Counting objects: 3, done.
Writing objects: 100% (3/3), 200 bytes | 0 bytes/s, done.
Total 3 (delta 0), reused 0 (delta 0)
To [email protected]:/usr/local/git_home/test_git_1.git
 * [new branch]      master -> master

查看分支情况:

[[email protected] test_git_1.git1]# git branch -av
* master                eb29488 commit test 1
  remotes/origin/master eb29488 commit test 1

0x06 结语

使用这种方法可以免去手动输入密码的步骤,因为使用了SSH密钥,还能提高安全性。还可以搭配自动化脚本来定时push,以便进行设备配置文件的定时备份。