Install Ubuntu’s gitolite3 package, run Gitolite under a dedicated Unix account such as git, import one administrator SSH public key, and then make every access change in the cloned gitolite-admin repository. Public keys in keydir identify virtual users; rules in conf/gitolite.conf grant read, write, or force-update rights. Committing and pushing that repository applies the policy without giving Git users an interactive shell on the server.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What Gitolite controls—and what it does not
Git itself transports objects and updates references; it does not provide a complete multi-user authorization policy for a shared server. Gitolite adds that policy at the SSH boundary. All Git connections use one dedicated Unix hosting account, normally named git, while each SSH public key maps to a separate virtual Gitolite username such as alice or carol.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
When a client connects, Gitolite’s forced SSH command examines the requested repository and operation. It allows or rejects the request according to the rules compiled from the administration repository. The account is not a general-purpose login: Gitolite’s user guide emphasizes, "You do not get a shell on the server — the whole point of gitolite is to prevent that!" A user can perform permitted Git operations, but cannot obtain an interactive shell through the Gitolite account.
The control plane is deliberately reviewable:
keydircontains public keys and therefore defines which virtual identities exist.conf/gitolite.confdefines repository, group, branch, and tag permissions.- A commit and push to
gitolite-adminregenerate Gitolite’s authorization data.
Do not edit generated files such as ~git/.ssh/authorized_keys, Gitolite’s internal state, or bare repositories by hand. Those files are outputs of the policy repository and can be overwritten or left inconsistent.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The Gitolite project describes the tool as allowing administrators to set up Git hosting with fine-grained access control and many other features. On Ubuntu, its main practical value is that operating-system access stays small while repository policy remains visible as ordinary text in Git.
Prerequisites and the dedicated hosting account
Use a server where you can install Debian/Ubuntu packages and create or administer a dedicated service account. Gitolite’s upstream documentation lists Git and Perl as prerequisites. SSH key authentication is the normal workflow; password authentication is not the usual way clients access Gitolite.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Keep the hosting account separate from human administrator accounts. It should own the Gitolite-managed home directory and repositories, but it should not be used for unrelated services or granted an interactive shell. If your organization already uses a different service-account name, substitute it consistently in the setup and remote URLs; the examples below use git.
Decide in advance who will hold the administrator key and where its private half will be protected. The public key is copied to the server only for initialization. Everyone else receives access as a Gitolite virtual user; they do not need a Unix account or a password on the Ubuntu host.
Install and initialize Gitolite on Ubuntu
1. Install the package
sudo apt install gitolite3The package installer may ask for an administrator public key and storage choices. Ubuntu’s documented procedure recommends leaving the hosting-username prompt empty when you want the account to be named git and intend to customize storage yourself. Read the prompts on your release rather than assuming every package version presents identical wording.
2. Create the dedicated Unix account
sudo useradd --system --home /home/git --create-home gitThis creates a system account with /home/git as its home directory. Ensure the account and its Gitolite-managed files remain owned and writable as Gitolite expects. Do not use a personal account as the service identity: doing so mixes shell access, personal SSH keys, and repository administration.
Use the same account name in all three places: the Unix account, the SSH destination (for example, git@yourserver), and the Git remote. A mismatch can make a valid key appear not to work because SSH is reaching a different account.
3. Prepare the administrator key
Use an SSH public key belonging to the person or automation identity that will administer users and permissions. The private key stays on the administrator’s workstation; only the public key is copied to the server for initialization.
cp ~/.ssh/id_ed25519.pub /tmp/admin.pubThe example assumes an Ed25519 key at that path. If your key has another filename or type, copy that public-key file instead. Treat /tmp/admin.pub as an initialization artifact and remove it after setup if it is no longer needed.
Do not copy a private key to the server. Gitolite needs only the public half, and later user keys should likewise be transferred as public-key files into the administration repository.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
4. Run Gitolite setup as the hosting account
sudo -i -u git gitolite setup -pk /tmp/admin.pubThe -p option imports the administrator public key and -k supplies the key filename. Gitolite’s normal SSH installation uses this gitolite setup -pk <admin>.pub pattern. After it completes, the administrator key can access the special gitolite-admin repository.
Run setup as the service account rather than as root or a personal user. That keeps the home directory, generated SSH authorization data, internal state, and repositories under the ownership Gitolite expects.
5. Confirm the first SSH connection
ssh git@yourserver
# or
ssh git@yourserver infoReplace yourserver with the server’s DNS name or address. A successful connection should produce Gitolite’s account overview rather than a shell prompt. The info form explicitly reports the repositories visible to the key being used. If SSH selects the wrong private key, specify the intended identity with your SSH client configuration or an appropriate -i option.
This first check confirms authentication and the forced-command path, but it does not prove that every repository rule is correct. Later, test actual clone, fetch, and push operations with the identities that will use them.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use gitolite-admin as the access-control workflow
Once the administrator key is installed, stop making policy changes on the server itself. Clone the administration repository to a workstation:
git clone git@yourserver:gitolite-admin.git
cd gitolite-adminEvery change should be understandable in a normal Git diff, committed with a meaningful message, and pushed for application. This gives you an audit trail and makes rollback a normal Git operation. It also avoids a common failure mode: editing a local file and assuming the server has changed when the administration repository was never pushed.
Before committing, inspect both the staged diff and the exact identity or rule being changed. A typo in a key filename, group name, repository name, or ref pattern is a policy error even when Git accepts the commit.
Add a user
Copy the person’s SSH public key into keydir. The filename, without the .pub suffix, becomes the virtual username used in rules.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutecp /path/to/alice.pub keydir/alice.pub
git add keydir/alice.pub
git commit -m "Add Alice"
git pushThe key file must contain the complete one-line SSH public key. A Gitolite user is a virtual identity, not an entry in /etc/passwd and not a second Unix account. If Alice later uses a different key, replace the file and push the change; if her access must end, delete the file, commit, and push:
git rm keydir/alice.pub
git commit -m "Remove Alice"
git pushRemoving the key revokes that virtual identity from Gitolite. It does not delete commits or repositories, so handle repository retention separately. Key rotation follows the same pattern: add the replacement public key under the intended username, remove the obsolete key file if appropriate, review the diff, and push.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Use groups to keep policy readable
Groups let you assign a role once and apply it to several repositories. A compact configuration is:
@developers = alice bob
@reviewers = carol
repo project
RW = @developers
R = @reviewers
RW+ = adminPlace this content in conf/gitolite.conf, then review and apply it:
git add conf/gitolite.conf
git diff --cached
git commit -m "Set project access"
git pushAfter the push, Gitolite regenerates its SSH authorization data and enforces the new rules. A later change to group membership is just another edit, commit, and push. Keep groups role-based rather than naming them after a single project when the same role is expected to apply in several places.
Choose the least-privilege permission class
| Rule | What it permits | Typical use | Risk or limitation |
|---|---|---|---|
R |
Read operations such as clone and fetch | Reviewers, auditors, or consumers who must not publish changes | Cannot push updates |
RW |
Read and ordinary write operations | Contributors who push normal branch or tag updates | Does not grant the force-update privilege implied by RW+ |
RW+ |
Read, write, and force-update operations | A trusted maintainer responsible for rewriting or rewinding refs | Can overwrite history or otherwise force-update refs; grant sparingly |
Think about repository scope, read versus write access, force-update ability, branch or tag restrictions, group membership, and how easily a reviewer can audit the change. In most teams, ordinary developers receive RW, a separate review group receives R, and only a small maintainer group receives RW+.
RW is not a weaker spelling of RW+; it intentionally withholds force updates. Treat the plus sign as a separate administrative capability. If a maintainer needs to rewrite only a development namespace, combine RW+ with a ref pattern instead of granting unrestricted force updates across the repository.
Restrict access to branches and tags with ref patterns
Repository-level rights can be narrowed to particular refs. For example:
repo project
RW = @developers
RW+ dev/ = alice
R = @reviewersHere, developers have normal write access under the repository’s general rule, while Alice has the force-update privilege for refs matching the dev/ pattern. Reviewers retain read access. Use patterns when a role should be able to update only a branch family or tag namespace, and inspect the resulting behavior with an actual test rather than assuming a pattern matches a ref you did not test.
Be especially cautious with rules that allow ref deletion or rewinding. A force-capable rule is an administrative capability, not simply “faster write access.” Keep it out of broad groups unless every member is trusted to rewrite the affected history. Test ordinary updates and force updates separately because they exercise different permissions.
Apply and verify each access change
Use the same sequence for new keys, removals, group edits, repository rules, and ref restrictions:
- Edit the appropriate files under
keydirand/orconf/gitolite.conf. - Review the diff, checking usernames, repository names, groups, permission classes, and ref patterns.
- Commit the change with a message that explains the decision.
- Push to
gitolite-adminand wait for Gitolite to process the update. - Run
ssh git@yourserver infowith the relevant key to see the repositories visible to that identity. - Perform a positive test: clone or fetch a repository the identity should read, and push a harmless test change when write access is intended.
- Perform a negative test: attempt a repository, operation, or ref that must be denied.
Normal repository URLs use the shared Unix account and the repository name, for example:
Recommended Free Tools
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
git clone git@yourserver:project.gitA successful overview does not prove every rule is correct. The decisive check is the real Git operation: clone, fetch, push, or a prohibited force update against the exact repository and ref involved. Run tests with the actual client keys, not only with the administrator key, because the administrator’s visibility is intentionally different.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Diagnose common failures
The connection opens a shell or is rejected before Gitolite responds
- Confirm that the remote uses the dedicated account, such as
git@yourserver, rather than a personal Unix username. - Check that the client is offering the private key corresponding to a file in
keydir. - Verify that the hosting account’s home, SSH directory, and Gitolite-managed files have the expected ownership and permissions.
- Do not “fix” the problem by manually editing
authorized_keys; correct the key ingitolite-adminand push it.
If a connection produces a shell prompt, verify that the SSH destination is the Gitolite account and that the account is using Gitolite’s forced command. A normal shell is not an expected Gitolite result.
The key connects, but info shows no expected repository
- Confirm the public-key filename exactly matches the username referenced in the configuration.
- Check that the repository rule names the same repository used in the remote URL.
- Review group membership and spelling in
conf/gitolite.conf. - Ensure the latest commit was pushed to
gitolite-admin; editing a local clone alone changes nothing on the server.
Clone or fetch works, but push is denied
The identity may have only R, may be outside the write-enabled group, or may be targeting a ref constrained by a pattern. Compare the requested repository and ref with the applicable RW rule. If the operation is a force push, ordinary RW is intentionally insufficient; grant RW+ only when the history rewrite is an explicit responsibility.
A rule appears correct, but a ref operation is still denied
Check the exact branch or tag name sent by Git and the pattern’s scope. Test a normal update and a force update separately. A broad repository rule and a narrower ref rule can produce different results for different refs, so test both the permitted path and the path that should remain blocked.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Policy design checklist
Before adding a rule, answer five questions: Which repository is in scope? Is the identity reading, making ordinary updates, or rewriting history? Should the permission apply to every ref or only a branch or tag namespace? Is the person receiving access directly or through a group? How will another administrator review and, if necessary, roll back the change?
These questions prevent common overbroad policies. A reviewer usually needs R, a contributor usually needs RW, and a force-capable maintainer should be named explicitly or placed in a small, well-understood group. Keep repository-specific exceptions close to the repository rule so a future reviewer can see why the exception exists.
Operational practices that prevent accidental privilege
- Keep the Gitolite Unix account dedicated and without interactive shell access.
- Use SSH keys, protect private keys on client machines, and remove obsolete public keys from
keydir. - Review every administration-repository diff before pushing it.
- Version-control all policy changes so an incorrect permission can be reverted cleanly.
- Separate read-only reviewers, normal contributors, and force-capable maintainers instead of assigning one broad group.
- Never hand-edit generated authorization files, Gitolite internal state, or bare repositories.
- After significant changes, verify both a permitted operation and a deliberately prohibited one.
For urgent revocation, remove the user’s public-key file from keydir, commit, and push. For a mistaken permission grant, revert the administration-repository commit and push the revert, then repeat the negative test. The repository history provides the record of both the original decision and its correction.
A complete minimal setup example
The following sequence creates one administrator, one developer, and one read-only reviewer for a repository named project:
# On the Ubuntu server
sudo apt install gitolite3
sudo useradd --system --home /home/git --create-home git
cp ~/.ssh/id_ed25519.pub /tmp/admin.pub
sudo -i -u git gitolite setup -pk /tmp/admin.pub
# On the administrator workstation
git clone git@yourserver:gitolite-admin.git
cd gitolite-admin
cp /path/to/alice.pub keydir/alice.pub
cp /path/to/carol.pub keydir/carol.pub
cat > conf/gitolite.conf <<'EOF'
@developers = alice
@reviewers = carol
repo project
RW = @developers
R = @reviewers
RW+ = admin
EOF
git add keydir conf/gitolite.conf
git commit -m "Add project users and permissions"
git push
# Verify with each relevant SSH identity
ssh git@yourserver info
git clone git@yourserver:project.gitUse the administrator’s key for the final administrative check, then repeat the overview and Git operations with Alice’s and Carol’s client identities. Alice should be able to read and perform ordinary pushes; Carol should be able to read but not push; only the administrator should have the force-update capability in this example.
Why this model is useful on Ubuntu
Gitolite’s model keeps operating-system access small while making repository authorization expressive. One service account can host many repositories, yet public keys remain distinct virtual identities and policy remains ordinary text in Git. The result is a clear separation: SSH authenticates the key, Gitolite authorizes the repository operation, and the administration repository records who changed that decision and when.
That separation is the practical answer to the two problems this setup is meant to solve: granting different people different repository privileges and preventing those people from turning Git access into a server login.
Frequently Asked Questions
How do I install Gitolite on Ubuntu?
Install Ubuntu’s gitolite3 package, create a dedicated git account, and initialize it with an administrator public key using sudo -i -u git gitolite setup -pk /tmp/admin.pub. Then clone gitolite-admin and manage policy there.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How do I add or remove a Gitolite user?
Add the user’s complete one-line public key as keydir/username.pub, commit, and push. To revoke that virtual identity, delete the key file, commit, and push. No Unix account is required.
What is the difference between R, RW, and RW+?
R permits reading, such as clone and fetch. RW permits reading and ordinary updates. RW+ also permits force updates that can rewind or overwrite refs, so reserve it for trusted maintainers.
How can I give access to one branch family only?
Use a ref-pattern rule in conf/gitolite.conf, such as RW+ dev/ = alice, and test both normal and force updates against the exact branch names involved.
Why can a user clone but not push?
The key may have only R, may not belong to the write-enabled group, or may be targeting a ref restricted by a pattern. Check the identity, repository name, group membership, and requested ref.
Can Gitolite users log in to the Ubuntu server?
No interactive shell should be available through the Gitolite account. Gitolite uses a forced SSH command that permits authorized Git operations while preventing a general-purpose server login.
Where should I edit authorized_keys or bare repositories?
Do not edit those generated or managed files directly. Change public keys and authorization rules in gitolite-admin, then commit and push so Gitolite regenerates its authorization data.
The Bottom Line
Use one dedicated Ubuntu git account, map SSH public keys to virtual users, and treat gitolite-admin as the sole control plane. Define R, RW, and narrowly scoped RW+ rules in conf/gitolite.conf, apply every change with a reviewed commit and push, and verify both allowed and denied Git operations. This delivers fine-grained repository access without granting users an interactive shell.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
