Ref T4151. Addresses these issues:
- Mentions diffusion.ssh-user.
- Mentions /etc/shadow and !!.
- Mentions /etc/passwd and shell.
- Mentions sshd -d -d -d.
- Mentions Defaults requiretty.
- Adds AllowUsers to default configuration.
- Mentions sudo -E ... as a troubleshooting step.
- Mentions multiple VCS binaries.
- Fixes sshd paths to be absolute.
- Fixes example path in sshd_config template.
- Mentions GIT_CURL_VERBOSE.
- Walks users through cloning.
- Adds documentation for custom hooks.
- Mentions that only daemon-user interacts with repositories.
- Added general troubleshooting guide.
I didn't fix these:
- Weird one-time issue with sudoers.d/. We tell you to edit /etc/sudoers directly anyway.
- Insane #includedir magic, as above.
- Confusion around vcs-user for HTTP, since I think this is fairly clear.
- Confusion around parent directory permissions -- not sure about this one, sshd normally runs as root?
I added an ssh-shell as a safer alternative to /bin/sh. I need to test this a bit more.