SSHD config: PermitUserEnvironment on a case-by-case basis

Question

I have a git server where people set up remote repositories over ssh, and there's a git user that they all connect as which has secure permissions and whatnot.

I'm editing the pre-receive hook in a repo so that it sees if the environment variable, $GIT_USER, matches the list of allowed users for that repo to prevent unauthorized users from pushing.

This environment variable is set individually in the git user's .ssh/authorized_keys file.

However, I don't want environment variables to be set for ssh for any user besides git.

Is there any way to edit /etc/ssh/sshd_config such that PermitUserEnvironment is only enabled for the git user?

Answer 1

The workaround would be to:

• keep PermitUserEnvironment to 'no'
• replace /usr/local/bin/git by a wrapper script which would:
  • set the relevant environment variables
  • call the actual git binary.