Step-by-Step Guide to Building a Secure Git Server and GitLab on CentOS 7

Creating the git user and group

First create a

git

group and a

git

user, then restrict the user to

git-shell

by editing

/etc/passwd

:

groupadd git

useradd -g git git

git:x:1001:1002::/home/git:/usr/bin/git-shell

This allows SSH access for Git operations while preventing interactive shell login.

Creating a bare repository

Switch to the git home directory, create a directory for the repository, and initialize it as a bare repo:

cd /home/git/

mkdir study.git

git init --bare study.git

Set ownership to the git user:

chown -R git:git study.git

Cloning the repository

Clone the repository via SSH. If the SSH daemon uses a non‑standard port, specify it in the URL:

git clone [email protected]:/home/git/study.git

git clone ssh://[email protected]:500/home/git/study.git

Setting up SSH key authentication

Edit

/etc/ssh/sshd_config

to enable public‑key authentication:

RSAAuthentication yes

PubkeyAuthentication yes

AuthorizedKeysFile .ssh/authorized_keys

Create the

.ssh

directory for the git user and set proper permissions:

mkdir .ssh

chmod 700 .ssh

touch .ssh/authorized_keys

chmod 600 .ssh/authorized_keys

Generate a key pair on the client with

ssh-keygen

and copy the public key to

/home/git/.ssh/authorized_keys

.

Installing GitLab on CentOS 7

Install required packages, start and enable

postfix

, then download and install the GitLab CE package:

yum -y install policycoreutils openssh-server openssh-clients postfix

systemctl enable postfix && systemctl start postfix

wget https://mirrors.tuna.tsinghua.edu.cn/gitlab-ce/yum/el7/gitlab-ce-8.9.5-ce.0.el7.x86_64.rpm

rpm -i gitlab-ce-8.9.5-ce.0.el7.x86_64.rpm

Configure the external URL in

/etc/gitlab/gitlab.rb

(replace with your server IP):

external_url 'http://192.168.188.222'

Run the reconfiguration script to install all components, then restart GitLab:

gitlab-ctl reconfigure

gitlab-ctl restart

Using GitLab

Access GitLab via the configured IP address, set an admin password, then create groups, projects, and users through the web UI. Permissions can be set at the group level (Private, Internal, Public) and per‑user role (Guest, Reporter, Developer, Master, Owner).

Backup and restore

Edit

/etc/gitlab/gitlab.rb

to enable backups (default directory

/var/opt/gitlab/backups

) and set the retention period (default 7 days). Then run:

/usr/bin/gitlab-rake gitlab:backup:create

To restore, stop services, run the restore command with the backup timestamp, and restart services:

gitlab-ctl stop unicorn

gitlab-ctl stop sidekiq

gitlab-rake gitlab:backup:restore BACKUP=1533281464

gitlab-ctl start unicorn

gitlab-ctl start sidekiq

After restoration the projects are available again.