[Solved] git daemon user: why is it created and can I get rid of it?

andrej · 2020-07-16 16:46:05

I'd like to have a user named `git` on a server hosting repos but it can't be created because it already exists.

Looking at git's PKGBUILD I see that there's some lines at the end that set up a "git deamon user". I've been using git for a decade and never heard of that and apparently it's something to manage repos? I didn't want to spend too much brain power reading through the docs because I don't care. Git works over SSH and I want it that way because it's simple.

Is there a simple way to prevent this user from being created on package installation? I know about the `pacman --noscriptlet` flag but I'm going to heed the warning because there's no user-friendly documentation about what exactly it does.

Personally, I'd drop this user creation from the install script as I don't see a compelling reason to keep it. If someone else agrees, I'll make a bug report.

Last edited by andrej (2020-07-16 19:48:56)

schard · 2020-07-16 17:47:06

The user has most likely been created by a corresponding sysusers file in order to provide a system user for said git daemon.
If you don't use this daemon, you can delete the system user an create an eponymous user for another purpose. However this most likely will lead to trouble, if you one day activate said service without realizing that it's now running within your custom user's context.

andrej · 2020-07-16 19:38:53

schard wrote:

If you don't use this daemon, you can delete the system user an create an eponymous user for another purpose. However this most likely will lead to trouble, if you one day activate said service without realizing that it's now running within your custom user's context.

I'm not concerned about ever using this daemon. But won't every update to the git package cause this user to be "recreated"? The only thing I'm concerned about with regards to this user are package upgrades.

Trilby · 2020-07-16 19:42:18

man sysusers.d wrote:

Files in /etc/sysusers.d override files with the same name in /usr/lib/sysusers.d ...

Just create an empty /etc/sysusers.d/git.conf to mask it.

andrej · 2020-07-16 19:48:26

Awesome, thanks!

schard · 2020-07-16 21:49:05

No. Systemd.sysusers will not override or modify existing users.

eschwartz · 2020-07-16 23:18:24

andrej wrote:

I'd like to have a user named `git` on a server hosting repos but it can't be created because it already exists.
Looking at git's PKGBUILD I see that there's some lines at the end that set up a "git deamon user". I've been using git for a decade and never heard of that and apparently it's something to manage repos? I didn't want to spend too much brain power reading through the docs because I don't care. Git works over SSH and I want it that way because it's simple.

It does, in fact, work over ssh. But how do you expose that ssh? Surely not as a user named git... ???

Traditionally, you give users a shell account, and they have write access to their repos. This works fairly well and is simple, though that shell account is a security risk to hand out to every Tom, Dick and Harry.

That's where dedicated users named "git" come in. They might be running git's builtin "instaweb" (gitweb), or a dedicated http server like cgit. Those might listen on the right port for the git:// url protocol too.
If you want random unauthenticated users to be able to clone read-only copies of the code, you'll need some sort of daemon to listen for git:// connections because ssh simply won't work for them.

Often, this git daemon user is used with cgit to publicly host repos, and the same repos are pushed to by their owners using ssh.

andrej · 2020-07-17 01:53:20

It's a private git server. All users with access to the user git will have all repositories for that user. There won't be any anonymous access. If I decide to add a web interface, I'll have the code mirrored to a different location/user via git hooks and that will then be served to some frontend. I don't have a need for any kind of web ui repo management or even gitolite.

eschwartz · 2020-07-17 02:07:56

andrej wrote:

All users with access to the user git will have all repositories for that user.

That's an interesting approach I don't believe I've seen done before, TBH.

Anyway, it's sufficiently unusual that I believe the git package is best served by continuing to provide the daemon user, and leaving people like you to override/mask the sysusers.d dropin. Fortunately, that's quite easy to do these days! Back in the day, though, the post_upgrade scriptlet would try running on every upgrade and run:

if ! getent passwd git >/dev/null; then
    useradd --system -c 'git daemon user' -g git -d / -s /usr/bin/git-shell git 
fi

(Though this would still be skipped if you have a conflicting user, it didn't let you prevent it from being created at all. sysusers.d is much more flexible.)

Arch Linux

#1 2020-07-16 16:46:05

[Solved] git daemon user: why is it created and can I get rid of it?

#2 2020-07-16 17:47:06

Re: [Solved] git daemon user: why is it created and can I get rid of it?

#3 2020-07-16 19:38:53

Re: [Solved] git daemon user: why is it created and can I get rid of it?

#4 2020-07-16 19:42:18

Re: [Solved] git daemon user: why is it created and can I get rid of it?

#5 2020-07-16 19:48:26

Re: [Solved] git daemon user: why is it created and can I get rid of it?

#6 2020-07-16 21:49:05

Re: [Solved] git daemon user: why is it created and can I get rid of it?

#7 2020-07-16 23:18:24

Re: [Solved] git daemon user: why is it created and can I get rid of it?

#8 2020-07-17 01:53:20

Re: [Solved] git daemon user: why is it created and can I get rid of it?

#9 2020-07-17 02:07:56

Re: [Solved] git daemon user: why is it created and can I get rid of it?

Board footer