Hello,

I'm hoping for help with my Error: not authorized to clone message.

I'll try to give (too many?) details below including what I've tried.

The system I'm on and information about the repository

• I'm using Fossil version 2.19

• I'm on a Linux system where I can log in to different machines (e.g., jupiter and saturn)

• My username is weigand

• Whether I login to jupiter or saturn I can cd into the directory with the fossils which is /projects/subprojects/fossils

• The repo I'm trying to clone is /projects/subprojects/fossils/aaa.fossil

• The results of fossil user capabilities weigand -R aaa.fossil is asv

• The Linux permissions for aaa.fossil are

  -rwxrw---- 1 userx groupx 2195456 Sep 13 12:13 aaa.fossil*
  

SCP works for aaa.fossil

• I have SSH keys set up and password-less login and I'm a member of groupx and SCP works for this same file:

scp weigand@jupiter:/projects/subprojects/fossils/aaa.fossil aaa.fossil
aaa.fossil                                     100% 2144KB  55.8MB/s   00:00 

The error on trying to clone

• This is my command and results:

fossil clone -sshtrace ssh://weigand@jupiter//projects/subprojects/fossils/aaa.fossil aaa.fossil

RUN ssh -e none -T -- 'weigand@jupiter' fossil test-http /projects/subprojects/fossils/aaa.fossil
Got line: [Status: 200 OK]
Got line: [Cache-control: no-cache]
Got line: [X-Frame-Options: SAMEORIGIN]
Got line: [Content-Type: application/x-fossil; charset=utf-8]
Got line: [Content-Length: 137]
Got line: []
Reading 137 bytes with 0 on hand...  Got 137 bytes
Got line: [Status: 200 OK] sent: 0  received: 0
Got line: [Cache-control: no-cache]
Got line: [X-Frame-Options: SAMEORIGIN]
Got line: [Content-Type: application/x-fossil; charset=utf-8]
Got line: [Content-Length: 137]
Got line: []
Reading 137 bytes with 0 on hand...  Got 137 bytes
Round-trips: 2   Artifacts sent: 0  received: 0
Error: not authorized to clone
Round-trips: 2   Artifacts sent: 0  received: 0
Clone done, wire bytes sent: 700  received: 562  ip: x.y.z.a (jupiter)
server returned an error - clone aborted
/***** Subprocess 13784 exit(1) *****/
 

• The person who is userx who owns the file is out of the country. In the past I successfully cloned aaa.fossil and I don't know what changed

• I got the same error before upgrading to Fossil 2.19

• I get the same result whether I try using weigand@jupiter or weigand@saturn

Success with a different repository file that "seems the same" to me

• If I try the same command with a different repo called bbb.fossil for which I also also have asv capabilities and which has the same Linux permissions, then I am successful.

fossil clone -sshtrace ssh://weigand@jupiter//projects/subprojects/fossils/bbb.fossil bbb.fossil
RUN ssh -e none -T -- 'weigand@jupiter' fossil test-http /projects/subprojects/fossils/bbb.fossil
Got line: [Status: 200 OK]
Got line: [Cache-control: no-cache]
Got line: [X-Frame-Options: SAMEORIGIN]
Got line: [Content-Type: application/x-fossil-uncompressed; charset=utf-8]
Got line: [Content-Length: 437286]
Got line: []
Reading 437286 bytes with 0 on hand...  Got 437286 bytes
Got line: [Status: 200 OK] sent: 0  received: 147
Got line: [Cache-control: no-cache]
Got line: [X-Frame-Options: SAMEORIGIN]
Got line: [Content-Type: application/x-fossil; charset=utf-8]
Got line: [Content-Length: 647]
Got line: []
Reading 647 bytes with 0 on hand...  Got 647 bytes
Round-trips: 2   Artifacts sent: 0  received: 154
Clone done, wire bytes sent: 706  received: 438237  ip: x.y.z.a (jupiter)
Rebuilding repository meta-data...
  100.0% complete...
Extra delta compression... 
Vacuuming the database... 
project-id: 082c97caa0fc5b358c00f43daeb363bfed2a1b77
server-id:  1be8c4711cf02788da0a3d6024925d29717bacf8
admin-user: weigand (etc., etc.)
/***** Subprocess 30182 exit(0) *****/

I don't know what I don't know

I'm clearly in a situation of not knowing what I don't know. I don't know what to look for to determine where aaa.fossil and bbb.fossil are different.

Thank you for any suggestions. I really appreciate Fossil, the support on the forum, and how SSH access allows my small team to use Fossil securely without any additional infrastructure.

Sincerely and appreciatively,

Stephen

What are the permissions on the parent directory of the fossil files?

Also is /projects/subprojects/fossils/aaa.fossil on a local disk or an NFS/SMB/other network mount?

Thank you very much for the response. The parent directories are drwxrws--x owned by userx or weigand with group being groupx.

I think the directory permissions are all OK (and bbb.fossil which works is in the same directory as aaa.fossil which I can't clone).

I don't know anything about network drives (unfortunately). My understanding is that the SSH is an OK way to deal with fossils on a networked filesystem.

Thank you again,

Stephen

One curious aspect of this is that I cannot find the text “not authorized to clone” in the source, other than as a substring of a longer text such as “You are not authorized to clone this repository.”

Thank you. I had searched the Forum and found this error in some postings:

https://fossil-scm.org/forum/forum?s=%22Error%3A+not+authorized+to+clone%22

(This is how I found out about the -sshtrace option.)

Postscript: For what it's worth I see something of a match on line 1443 of xfer.c:

https://fossil-scm.org/home/file?udc=1&ln=1437,1446&ci=trunk&name=src%2Fxfer.c

I'm not qualified to answer, really, but you did find the source of the message.

The Clone permission is "g" in the user permission screens. Normally "nobody" (not logged in users) has the g capability set. Take a look at the Admin -> Users screen (from fossil ui if allowed or fossil user capabilities nobody) and see if you might be able to suss out a difference in aaa and bbb fossils with regards to the weigand user and the nobody user. Umm, maybe. ;-)

Have good

The Clone permission is "g"

Fossil ignores the RBAC over SSH unless you force it.

Thank you for both comments. I suppose it is moot because of Warren's point but aaa.fossil and bbb.fossil had the same user capabilities. I thought that could have been a problem.

I now see that the help for test-http says this command is used internally by the ssh sync protocol and test-http takes an argument named --usercap which defaults to sxy.

(By the way, this table of capabilities (i.e., cap reference) is really nice.)

Next step for me...

I suspect that there is some interaction between taking a repository completely private and cloning/syncing over SSH which I need to understand better.

Below are the results with the --httptrace option (with me adding line numbers) but first here are the results with only the -v option

i've unfortunately got nothing to add to what others have suggested (and Andy is very likely our foremost fossil-over-ssh expert), but...

 8	error not\sauthorized\sto\sclone

That explains why that message couldn't be found in the sources earlier:

[stephan@nuc:~/f/fossil/src]$ grep -n 'not\\sauthorized\\sto' *.c
xfer.c:1090:  @ error not\sauthorized\sto\ssync\sprivate\scontent
xfer.c:1269:        @ error not\sauthorized\sto\swrite
xfer.c:1290:        @ error not\sauthorized\sto\swrite
xfer.c:1413:          @ error not\sauthorized\sto\sread
xfer.c:1422:            @ error not\sauthorized\sto\swrite
xfer.c:1425:            @ message pull\sonly\s-\snot\sauthorized\sto\spush
xfer.c:1443:        @ error not\sauthorized\sto\sclone
xfer.c:1536:        @ error not\sauthorized\sto\spush\sconfiguration

Does the localauth setting differ between the two?

Yes!!! Thank you, Warren! (And thank you to everyone who suggested other things to look into.)

I did a diff on the settings for aaa.fossil and bbb.fossil and entered these commands to make them match:

fossil settings localauth 0 -R aaa.fossil 
fossil unset lock-timeout -R aaa.fossil

It worked. Nice! Thanks to all who helped.

It certainly fails the principle of least surprise. I only came up with that guess by RTFS.