记一次gitee使用WebHooks踩坑笔记！

2016-06-12 阅读:次

踩坑：添加的是root用户的公钥，执行拉代码的是www用户。
root登录服务器，创建公私钥。然后把公钥添加到gitee并启用。gitee创建仓库，clone到本地修改代码后，提交到仓库。调用WebHooks往服务器推送数据，服务器的钩子文件执行git pull拉取代码一直提示无权限。

gitlab.php钩子文件代码：


// 获取请求参数
$headers = getallheaders();
 
$body = json_decode(file_get_contents("php://input"), true);
// 请求密码
$password = 'test';

// 验证提交分支是否为master
if (!isset($body['ref']) || $body['ref'] !== 'refs/heads/master') {
    echo '非主分支' . $body;
    exit(0);
}

// 验证提交密码是否正确
if (!isset($body['password']) || $body['password'] !== $password) {
    echo '密码错误';
    exit(0);
}
 

// 验证成功，拉取代码 origin master
 
$user = shell_exec("whoami"); //服务器上先把shell_exec和exec函数禁用解除
echo $user; //输出服务器执行git pull 的用户是谁
$command = 'cd /www/wwwroot/' . $body['project']['path'] . ' && pwd && git pull 2>&1';
$res = shell_exec($command); 
var_dump($res); //打印执行结果

提示："error: cannot open .git/FETCH_HEAD: Permission denied" 给该文件写权限

把git pull 改成sodu git pull提示如下：

"/www/wwwroot/test
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

sudo: no tty present and no askpass program specified"

用户权限有问题。当前执行拉代码的用户是www，而shell登录的是root，用root手动执行git pull是没问题，就是钩子文件执行没权限。提示：
"Host key verification failed.fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists."

那就从root切换到www用户:su - www，之前服务器做了安全限制，www没有登录shell的权限,把www:x:1000:1000::/home/www:/sbin/nologin改成/bin/bash再执行切换用户。切换后，重新生成公钥，添加到gitee启用。

#www用户无登录shell权限,此帐户当前不可用。
[root@xxx ~]# su - www
Last login: Mon Nov 22 00:30:12 CST 2021 on pts/0
This account is currently not available. 

#修改权限后，切换www，提示没权限进入root目录
[root@xxx ~]# su www
[www@xxx root]$ ls
ls: cannot open directory .: Permission denied

#提示没权限，公钥问题
[www@xxx test]$ git pull
The authenticity of host 'gitee.com (212.64.62.183)' can't be established.
ECDSA key fingerprint is SHA256:FQGC9Kn/eye1W8icdBgrQp+KkGYoFgbVr17bmjey0Wc.
ECDSA key fingerprint is MD5:27:e5:d3:f7:2a:9e:eb:6c:93:cd:1f:c1:47:a3:54:b1.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'gitee.com,212.64.62.183' (ECDSA) to the list of known hosts.
Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

[www@xxx test]$ cd ~/.ssh/
[www@xxx .ssh]$ ls
known_hosts   
[www@xxx .ssh]$ cat known_hosts
gitee.com,212.64.62.183 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMuEoYdx6to5oxR60IWj8uoe1aI0X1fKOHWOtLqTg1tsLT1iFwXV5JmFjU46EzeMBV/6EmI1uaRI6HiEPtPtJHE=
[www@xxx .ssh]$ ssh-keygen -t id_rsa -C "www@root.com"  
unknown key type id_rsa
[www@xxx .ssh]$ ssh-keygen  -C "www@root.com"
Generating public/private rsa key pair.
Enter file in which to save the key (/home/www/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/www/.ssh/id_rsa.
Your public key has been saved in /home/www/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:eRDd0kEWu6yOVvqS2xGJ7fP4jirbGGIm0XFMuMXa1v8 www@root.com
The key's randomart image is:
+---[RSA 2048]----+
|     o. .. +=o   |
|    .oo  .o.o.   |
|    .=o..  ..    |
|   .ooo .= o .   |
|  . ..  S.= o    |
|   .     ooo     |
|  . + .  +=.     |
|   + ..+=+ *E    |
|      o+==*o+    |
+----[SHA256]-----+
[www@xxx .ssh]$ ls
id_rsa  id_rsa.pub  known_hosts
[www@xxx .ssh]$ cat id_rsa.pub
ssh-rsa ... www@root.com  #公钥
[www@iZbp19n36uysr947rrddpaZ .ssh]$ ls
id_rsa  id_rsa.pub  known_hosts

本地修改代码后执行git push origin master 就会看到触发的钩子在服务器执行git pull成功了。

www #打印的当前用户
"/www/wwwroot/test
From gitee.com:gitlabstack/wuyoutuike
   de7b10a..89dad46  master     -> origin/master
Updating de7b10a..89dad46
Fast-forward
 test.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)"

可能会用到的点：
服务器生成公钥：ssh-keygen -t id_rsa -C "xxx@xx.com" 或ssh-keygen -C "xxx@xx.com"
服务器验证公钥：ssh -T git@gitee.com成功会提示如下：
Hi Anonymous! You've successfully authenticated, but GITEE.COM does not provide shell access.

git使用ssh方式git@gitee.com:xxx/xxx.git操作报错
解决：把当前操作git的电脑或服务器公钥添加到代码仓库所在服务器，部署并启用！

C:\Users\DragonersLi\Desktop>git clone git@gitee.com:gitlabstack/xxx.git
Cloning into 'test'...
[session-58450d89] Auth error: Access deined: authorize failure.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

本文链接： https://dragonersli.github.io/2016/06/12/记一次gitee使用WebHooks踩坑笔记！/
本人声明： 此文只作为自己日后工作学习中遇到类似问题方便快速回忆解决问题的笔记，仅供参考！
版权声明：

本文首发于すせなの筆記转载无需联系本人，但要注明来源本站！