What are the pros and cons of SSH and HTTP for a git server?

Question

I want to setup a git server. I have found several how-to's, well detailed.

Some describe the installation for a git-server accessible thru Ssh, while others, accessible thru HTTP. ( Others even advise tools like gitolite ).

Are there pros or cons choosing over SSH or HTTP? It seems that by HTTP, the file transfer is significantly slower, but I wonder if there are other things to keep in mind.

What is the most common way of setting up a git server, if any?

Solution 1

While you're asking for what is the most common way, I think it's better to look at your situation and remember that one protocol doesn't exclude another - add more access protocol later if you need them.

• Most efficient and fast is to use the native Git daemon. However, little features offered: no encryption, no authentication. Ideal for public read-only mirrors of your repositories. If you need performance, also consider installing a recent version rather than the version shipped with your OS.

• Most compatible way is HTTP. Less efficient than native Git, but not that much of a difference either. Most important pro of HTTP is firewall penetration and proxy support. It appears as regular other HTTP traffic for most gateways/firewalls.

• More secure is HTTPS, but inevitably less efficient too. Requires quite some configuration. You'll also need a trusted TLS certificate.

• Similar security, but a more common way is to use SSH. It is the default if no protocol is specified on command line. Powered by SSH, it provides strong encryption and both password and key authentication. While unconventional, it is possible to allow anonymous access this way too.

My advise would be depending on the use case of your repositories:

• private repositories & small user group: SSH

• public repositories, any amount of clones, but small group of push-privileged users: HTTP and Git (fetch-only) + SSH (+push-access)

• any of the above, but with large amount of push-privileged users: you probably don't understand the philosophy of Git.

Some public or corporate networks might block Git and SSH traffic. If you really need to access your repositories from anywhere, consider using both HTTPS and SSH.

Solution 2

You can use HTTPS for read-only access, if your repositories are public as it is easy to use on the client side. If not you should only use SSH. In any case you should use SSH for write access as it has better authentication management.

Comments

[Stephane Rolland]

oh, so it is possible to mix the two ? SSH for write and read access, and Https for easy read-only access ?

[WhyNotHugo]

You can get free TLS certificates for HTTPS from startssl.com. Trusted by all major OSs/Browsers.

[Tereza Tomcova]

Or letsencrypt.org