Server - XiZi's Blog

Git Over Http: Service not enabled: 'receive-pack'

如果你使用了Git的git-http-backend 后台服务 (git push/pull/clone over http instead of ssh or git),并且没有配置客户端认证。你可以在push的时候遇到这个错误: The requested URL returned error: 403..,查看apache后台提示错误:Service not enabled: 'receive-pack'。 


 在git response 目录下执行下面的命令,以打开匿名情况下的http.receivepack服务。

git config --file config http.receivepack true



# Set this to the root folder containing your Git repositories.
# 指定 Git 版本库的位置
SetEnv GIT_PROJECT_ROOT F:/Dropbox/GitRepo
# Set this to export all projects by default (by default,
# git will only publish those repositories that contain a
# file named “git-daemon-export-ok”
# 该目录下的所有版本库都可以透过 HTTP(S) 的方式存取

# Route specific URLS matching this regular expression to the git http server.
# 令 Apache 把 Git 相关 URL 导向给 Git 的 http 处理程序
AliasMatch ^/git/(.*/objects/[0-9a-f]{2}/[0-9a-f]{38})$          "F:/Dropbox/GitRepo/$1"
AliasMatch ^/git/(.*/objects/pack/pack-[0-9a-f]{40}.(pack|idx))$ "F:/Dropbox/GitRepo/$1"
ScriptAliasMatch \
        "(?x)^/git/(.*/(HEAD | \
                        info/refs | \
                        objects/info/[^/]+ | \
                        git-(upload|receive)-pack))$" \
        "D:/Program Files (x86)/Git/libexec/git-core/git-http-backend.exe/$1"
<Directory "D:/PROGRA~1/Git/libexec/git-core/">
	Options Indexes FollowSymLinks
	AllowOverride AuthConfig
	order allow,deny
	allow from all
<Directory "F:/Dropbox/GitRepo">
	Options Indexes FollowSymLinks
	AllowOverride AuthConfig
	order allow,deny
	allow from all





. /etc/rc.common

function enipfw() #添加防火墙规则
    ipfw -f flush
    ipfw add allow all from any to me ssh
    ipfw allow all from any to me http
    ipfw allow all from any to me https
    ipfw add allow all from any to me openvpn
    ipfw add allow all from any to me ftp
    ipfw add 90 allow all from any to me 5900
    ipfw add divert natd all from any to any via en0
    ipfw add pass all from any to any


  case $1 in
      ConsoleMessage "Starting NATD"
      sysctl -w net.inet.ip.forwarding=1 #设置网关
      natd -s -m -d -n en0 -dynamic #启动Nat
      sysctl -w net.inet.ip.fw.enable=1 #开启防火墙
      ConsoleMessage "Stopping NATD"
      sysctl -w net.inet.ip.forwarding=0
      killall natd
      ipfw -f flush
      sysctl -w net.inet.ip.fw.enable=0
      ConsoleMessage "Restarting NATD"
      killall natd
      sleep 10
      sysctl -w net.inet.ip.forwarding=1
      sysctl -w net.inet.ip.fw.enable=1





  Description     = "NATD";
  Provides        = ("NATD");
  Requires        = ("Network");
  OrderPreference = "none";
  Messages        =
      start       = "Starting NATD";
      stop        = "Stopping NATD";
      restart     = "Restarting NATD";

OK, 完成以上工作可以修复文件夹权限并启动NATD服务了。

sudo chown -R 0:0 /Library/StartupItems/NATD #修复所有者
sudo chmod -R 755 /Library/StartupItems/NATD #修复权限
sudo SystemStarter -vd start NATD #启动服务

Just a copy of How to Install OpenVPN with bridge mode


How to Install Openvpn


When I first decided to create my own server I ran down a list of elements I wanted. The first were obvious, web-server, and e-mail server. However I also realized that I have many games that I would enjoy playing with friends. These are older games that only allow multiplayer over local networks. A very secure and novel solution is to use OpenVPN to make the remote computers appear as though they are on the same local network. So I set out to implement this on my second computer. I used Ubuntu Dapper Drake server edition and then began the painstaking task of configuring all the components. However when I tried to configure OpenVPN the documentation on their web-site was lacking. It has been updated and is very good now (this was in March of 2006) but I wrote a guide to installing and configuring OpenVPN on Ubuntu Dapper Drake. I hope you find this interesting and beneficial.


The purpose of this document is to describe how to install OpenVPN server on an Ubuntu Linux system and have it utilize an Ethernet bridge to access your local network. Ethernet bridges essentially allow the operating system to treat multiple network interfaces as one combined port. When used with OpenVPN a bridge will allow you to easily connect external users to your internal network and have them receive all traffic as though they were locally connected. The alternative is to use OpenVPN with a route but that will not allow some forms of traffic through (such as multicast), multicast traffic is important to me as many games require multicast data.

What is needed:

  1. Linux System running Ubuntu (tutorial will work with any Linux install with a few modifications)
  2. Root access to the server
  3. External computer to test with


This tutorial aims to instruct how to install and configure an OpenVPN server with internal network access via an Ethernet bridge. This tutorial does not explain how to install Linux and get the OS environment configured. There are many good tutorials out there that you can use, once you have your Linux server ready simply follow this document.

If you are interested in a tutorial to configure your system I recommend this easy to follow guide:


1. The first thing you should do when installing OpenVPN is to read some of the documentation on the OpenVPN web-site. This seems like a simple step to skip but if you do not know exactly how OpenVPN works then you risk opening your internal network to security problems. Additionally there is a lot of good documentation on the OpenVPN site that will help you understand networking terms and methods. Such as exactly what an Ethernet Bridge is and how it differs from a route.

			# Link to OpenVPN Homepage             
			# Link to Explanation of bridging   	 

2. Now that you have taken some time to understand OpenVPN and Bridges we can begin to implement these technologies into a server on your local network. The first step is to collect information about your network, this tutorial is designed for a network that meets the following:

			Linux Server Internal IP: 	
			Internet Gateway: 	
			Gateway's IP Address:  	
			Network Layout: 	Internet ----- Router/Firewall ----- OpenVPN Server (eth1) 

3. To simplify setup for users you should register your IP address with an Internet Domain service. If you are cheap like me simply use "". Create an account then download their dynamic dns update tool and follow their installation instructions. This will give you a free dynamic domain. Additionally the IP address for your server needs to be static, this is due to the fact that the bridge will not update on a DHCP IP address change. You can configure this in your /etc/network/interfaces file. My server has an entry for my network card that looks like this:

			# The primary network interface
			# connects to insecure router
			auto eth0
			iface eth0 inet static
			# dns-* options are implemented by the resolvconf package, if installed

4. Now that the information is collected you can begin by installing OpenVPN and the utilities to manage a bridge, to do this simply type:

			sudo apt-get install openvpn bridge-utils 

5. With OpenVPN installed we can now begin to configure, the first step is to move the apt-get directory into /etc/openvpn for easy access, and to preserve the original data (in case you mess up and need to revert).

			 cp -R /usr/share/doc/openvpn/examples/ /etc/openvpn/

6. Now we want to load the vars file with our own defaults. Open the file in your favorite editor and change KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL to match your information.

			cd /etc/openvpn/examples/easy-rsa/ 	
			vi ./vars 	 

My vars file looks like this: (key components only)

			#this is to ensure secure data
			export KEY_SIZE=2048
			# These are the default values for fields
			# which will be placed in the certificate.
			# Don't leave any of these fields blank.
			export KEY_COUNTRY=CA
			export KEY_CITY=Martensville
			export KEY_ORG="TheBakershome"
			export KEY_EMAIL=""

7. Now we to begin the configuration of the server.

			. ./vars 	

The purpose of these command are as follows, the first one will clear any old keys or configuration elements, there should not be any there but it does not hurt to be sure. The last command will setup OpenVPN configuration items, be sure to follow the prompt and make sure you fill in using elements to match your situation. Since we loaded the vars file with your settings prior to these steps the default values should work on almost all elements, but the Common Name will need to be specified.

8. Now you need to create the server keys, these are private files that you should keep secure.

			./build-key-server server 
I found that if I did not use the same information that I used in the build-ca step above that the "Sign Certificate" and "commit" did not work. If you experience this problem just repeat this step with the same values, it should work at that point. This should not occur for you as we have loaded the default values into the vars file, but just in case be aware of the cause.

9. Now you are ready to generate keys for users, first decide if you wish to password protect the keys or not. I recommend building with passwords if you are not going to implement authentication in OpenVPN, if you are then simply generate without. This tutorial will assume that you are going to implement authentication in OpenVPN, since it is the most trusted method. Make sure that you specify the correct Common Name when prompted.

			#Generate with password 	  
			./build-key-pass username  	
			#Generate without password 	  
			./build-key username 

10. Now you need to build the Diffie Hellman parameters, for details on what these are simply check the OpenVPN homepage. The simple answer is that they provide a method to negotiate a secure connection over an insecure channel. This process will take a bit of time so you may want to take a break, just relax we are almost there.

			#generate server id key
			openvpn --genkey --secret ta.key

11. As an aside I found a very interesting table on the OpenVPN web-page. It provides some information on what to do with the various files we just generated. For the purposes of this tutorial I have "borrowed" their table and pasted it here, to view the original visit the OpenVPN installation guide on their homepage.

Filename Needed By Purpose Secret
ca.crt server + all clients Root CA certificate NO
ca.key key signing machine only Root CA key YES
dh{n}.pem server only Diffie Hellman parameters NO
server.crt server only Server Certificate NO
server.key server only Server Key YES
ta.key server+ all clients Server TLS Auth Key YES
client1.crt client1 only Client1 Certificate NO
client1.key client1 only Client1 Key YES
client2.crt client2 only Client2 Certificate NO
client2.key client2 only Client2 Key YES
client3.crt client3 only Client3 Certificate NO
client3.key client3 only Client3 Key YES

12. Now we need to configure the server.conf file to setup the operation. Here is my configuration file:

			# Which local IP address should OpenVPN 
			# listen on? (optional) 
			port 1194
			# TCP or UDP server? 
			proto udp 
			#This is key to configuring our bridge 
			dev tap0 
			#direct these to your generated files 
			ca /etc/openvpn/openvpn/examples/easy-rsa/keys/ca.crt 
			cert /etc/openvpn/openvpn/examples/easy-rsa/keys/server.crt 
			key /etc/openvpn/openvpn/examples/easy-rsa/keys/server.key   
			dh /etc/openvpn/openvpn/examples/easy-rsa/keys/dh2048.pem 
			ifconfig-pool-persist ipp.txt 
			#ensure the range of ip addresses you use in the last  two arguments 
			# of this statement are not in use by  either the DHCP server or any other
			# device on your  internal network. 
			#needed to allow communication to internal network 
			keepalive 10 120 
			#encryption - very important ;) 
			#AES encryption is backed by many security firms
			#however if you are concerned about speed use blowfish: "BF-CB"
			cipher AES-128-CBC  
			#if you have another subnet you need to provide the route
			push "route"
			#server id protection
			tls-auth ta.key 0
			#compression for network speed 
			# if packets are too large fragment them (only really useful if you have an old router) 
			#fragment 1400 
			#limit the number of connections
			max-clients 5
			#some secuurity settings 
			# do not use if running server on Windows
			user nobody 
			group nogroup 
			#log file settings 
			status openvpn-status.log 
			verb 3 
			# authentication plugin
			#forces client to have a linux acount in order to connect
			plugin /usr/lib/openvpn/ login 

13. Now that the server is configured we need to create the bridge interface. The bridge is managed by Linux and is only used by OpenVPN so setup is a little different. I did it using a script to start/stop the interface. Place this script in "/etc/init.d/bridge" and then run the following:

			update-rc.d bridge defaults 15 

Here is the script, before using you will need to edit it for your network and server settings.

			# Create global variables   
			# Define Bridge Interface 
			# Define list of TAP interfaces to be bridged, 
			# for example tap="tap0 tap1 tap2". 
			# Define physical ethernet interface to be bridged 
			# with TAP interface(s) above. 
			start_bridge () {   
			# Set up Ethernet bridge on Linux   
			# Requires: bridge-utils   
			for t in $tap; do
			openvpn --mktun --dev $t   
			for t in $tap; do
			ifconfig $t promisc up   
			ifconfig $eth promisc up
			brctl addbr $br 
			brctl addif $br $eth
			for t in $tap; do
			brctl addif $br $t   
			ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast up   
			route add default gw $gw $br
			stop_bridge () {   
			# Tear Down Ethernet bridge on Linux   
			ifconfig $br down
			brctl delbr $br    
			for t in $tap; do
			openvpn --rmtun --dev $t   
			ifconfig $eth $eth_ip netmask $eth_netmask broadcast $eth_broadcast up   
			route add default gw $gw $eth
			case "$1" in 
			echo -n "Starting Bridge"   
			echo -n "Stopping Bridge"   
			sleep 2   
			echo "Usage: $0 {start|stop|restart}" >&2   
			exit 1   

14. Now you need to edit your client configuration script, client.conf. This will be given to your clients and will be the script they invoke (via openvpn) to connect to your server. In the same way you modified the server.conf file edit the network information to match your internal network. Here is an example of one of my scripts:

			dev tap 
			proto udp 
			# change this to your server's address 
			remote 1194 
			resolv-retry infinite 
			# Point the key and crt files to  
			# the ones for this user 
			ca ca.crt 
			cert geoff.crt 
			key geoff.key 
			#ensure that we are talking to a server 
			ns-cert-type server
			#confirm we are talking to the correct server 
			tls-auth ta.key 1
			# Select a cryptographic cipher. 
			# If the cipher option is used on the server 
			# then you must also specify it here. 
			cipher AES-128-CBC 
			# Enable compression on the VPN link. 
			#fragment large packets 
			# I found I needed this for some games but it is 
			# not required
			#fragment 1400  
			# enable user/pass authentication

15. Now you are ready to test your server, to do this load the server from the command line:

			sudo /etc/init.d/bridge start 	
			sudo openvpn /etc/openvpn/server.conf 

##Look for any errors that may be reported while OpenVPN parses the server.conf file. If it gets to the "Succeeded" state then switch computers to a PC on an external network (I used my PC at work) and open the OpenVPN connection. If everything is working here reboot your server and attempt to open the connection again, this will ensure that everything is booting correctly.

###Once the connection is established by the client test it by pinging devices on your internal network. Assuming everything is connected correctly you should be able to contact them.

16. If you have any troubles with step 16, the first place to look is at firewalls. If your server has firewall restrictions they may be blocking the bridge from operating, check your config and adjust as necessary. At this point your server should be running, good luck and have fun.


I ended up having some difficulty configuring shorewall on my openvpn server. It is a little tricky since you have to tell shorewall to differentiate between a physical input (eth0) and the virtual input (tap0). To do this open "/etc/shorewall/hosts" and add:

			net     br0:eth0
			vpn     br0:tap0

This will tell shorewall to differentiate between the vpn and the insecure traffic. Once you have this data you need to add the following to your policy file. This will tell shorewall that the traffic from the vpn is trusted so just let it all through.

				vpn     all     ACCEPT

You will also need to mention the vpn in the zones file by adding

				vpn     ipv4

Lastly you will need to tell shorewall that a tunnel is coming through by opening the tunnels file and adding:

				openvpn        net       vpn


I hope your server is working good and that you can now play your old classic games with friends. The other benefit of this network is that you can access your data on your home PC from anywhere and you will be certain that your connection if free from intrusion.

Host by | Power by Chito 1.3.3 beta | © 2007 LinuxGem | Design by Matthew "Agent Spork" McGee