1

I have one user for deployment on the server and there are multiple developers who have to deploy. (I could create multiple deployment users, but that's quite costly on this managed server) Therefore, I want to access a host with a specific user, but I want this user to have multiple SSH keys.

I have created the ssh keys for each user, added them in the ssh agent and bitbucket, so that each user can run commands like git pull or git push. My problem is that the developer must write the whole repo url with the username after every command e.g. git pull [email protected]/company-name/repo.git

Is there a way to avoid writing the whole repo url ? and maybe just write the username or the host from the config file ?

1 Answer 1

3

You should take this problem apart, into its individual pieces:

  • Git is going to run ssh when given an ssh URL. Git knows nothing1 about ssh other than that Git should run ssh, and once ssh says "it's working", Git will be speaking Git-protocol to another Git-protocol-speaker. The ssh command that Git will run comes from GIT_SSH_COMMAND or core.sshCommand or a built in default (there are several other settings but you shouldn't use them at this point, they are leftovers from the past).

  • Git also has url.<base>.insteadOf settings for rewriting URLs. Other than this and the fact that user@host:path "becomes" ssh://user@host/path, that's the end of all of the Git knobs.

  • Ssh has configuration files. These control things like the encryption to be used, and default settings like the user name (which for Bitbucket is always going to be git). You basically run ssh options user@host and anything you didn't specify (including the user name) comes from a default. Since Git doesn't specify anything other than the user@host part, or just the host part if the Git URL has the form ssh://host/path/to/repo instead of ssh://user@host/path/to/repo.

This gives you the sum total of everything you can play with.

Note (again) that when contacting bitbucket.org you must always attempt to log in, via ssh, as user git. Bitbucket then decides who you are—i.e., does its authentication—based on the public key you provide. So to log in to Bitbucket as Bruce Wayne, you connect as [email protected]. To log in to Bitbucket as Bruce Lee, you still connect as [email protected]. What you change is the public key that you have ssh deliver and that's based on ssh configurations and settings.

The most useful one here is that ssh reads its ~/.ssh/config file and finds settings of the form:

Host brucewayne
    User git
    Hostname bitbucket.org
    IdentityFile ~/.ssh/id_brucewayne
    IdentititesOnly yes

Host brucelee
    User git
    Hostname bitbucket.org
    IdentityFile ~/.ssh/id_brucelee
    IdentititesOnly yes

The IdentityFile line is what controls how you present yourself to Bitbucket.

Beyond that, the URL you use just goes on to bitbucket, so what you'll be doing, in general, is fiddling with the apparent host name. That is, instead of:

git clone ssh://[email protected]/company/repo.git

you'll run:

git clone ssh://brucewayne/company/repo.git

when you want to pretend to be Bruce Wayne, and:

git clone ssh://brucelee/company/repo.git

when you want to pretend to be Bruce Lee.

You do have a few other options, if this isn't suitable for some reason. In particular, you can use the GIT_SSH_COMMAND or core.sshCommand setting to run some program other than ssh, and have that other program rewrite the URL and/or insert -o options and then run ssh. See the bullet points above.


1Well, almost nothing. There's some special case code in Git to try to deal with several different known ssh implementations. But this has no bearing on your particular problem here unless you make use of the "fake up an ssh script that runs the real ssh". In this case, see the git config documentation and search for ssh.variant.

Sign up to request clarification or add additional context in comments.

1 Comment

i got Bad configuration option: identititesonly and remove the last line solved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.