diff --git a/doc/3-faq-tips-etc.mkd b/doc/3-faq-tips-etc.mkd
index 8f5a5a5..aacea24 100644
--- a/doc/3-faq-tips-etc.mkd
+++ b/doc/3-faq-tips-etc.mkd
@@ -102,10 +102,10 @@ normal way, since it's not empty anymore.
     So at least one of your clients needs to have a recent git.  Once at least
     one commit has been made, older clients can also use it
 
-  * when you clone an empty repo, git seems to complain about the remote
-    hanging up or something.  I have no idea what that is, but it doesn't seem
-    to hurt anything.  This happens even in normal git, not just gitolite.
-    [Update 2009-09-14; this has been fixed in git 1.6.4.3]
+  * when you clone an empty repo, git seems to complain about `fatal: The
+    remote end hung up unexpectedly`.  However, you can ignore this, since it
+    doesn't seem to hurt anything.  [Update 2009-09-14; this has been fixed in
+    git 1.6.4.3]
 
   * gitweb not able to read your repos?  You can change the umask for newly
     created repos to something more relaxed -- see the `~/.gitolite.rc` file
diff --git a/src/ga-post-update-hook b/src/ga-post-update-hook
index 8090b8a..91d2bfb 100755
--- a/src/ga-post-update-hook
+++ b/src/ga-post-update-hook
@@ -1,10 +1,7 @@
 #!/bin/sh
 
-# get this from your .gitolite.conf; and don't forget this is shell, while
-# that is perl :-)
-export GL_ADMINDIR; GL_ADMINDIR=$HOME/.gitolite
-
 # checkout the master branch to $GL_ADMINDIR
+# (the GL_ADMINDIR env var would have been set by gl-auth-command)
 GIT_WORK_TREE=$GL_ADMINDIR git checkout -f master
 
 # remove all fragments.  otherwise, you get spurious error messages when you
@@ -31,4 +28,4 @@ do
 done
 
 cd $GL_ADMINDIR
-src/gl-compile-conf
+$GL_BINDIR/gl-compile-conf
diff --git a/src/gitolite.pm b/src/gitolite.pm
index 56336de..23f7e23 100644
--- a/src/gitolite.pm
+++ b/src/gitolite.pm
@@ -27,8 +27,8 @@ $W_COMMANDS=qr/^git[ -]receive-pack$/;
 # note that REPONAME_PATT allows "/", while USERNAME_PATT does not
 # also, the reason REPONAME_PATT is a superset of USERNAME_PATT is (duh!)
 # because in this version, a repo can have "CREATER" in the name (see docs)
-$REPONAME_PATT=qr(^\@?[0-9a-zA-Z][0-9a-zA-Z._\@/-]*$);  # very simple pattern
-$USERNAME_PATT=qr(^\@?[0-9a-zA-Z][0-9a-zA-Z._\@-]*$);   # very simple pattern
+$REPONAME_PATT=qr(^\@?[0-9a-zA-Z][0-9a-zA-Z._\@/+-]*$); # very simple pattern
+$USERNAME_PATT=qr(^\@?[0-9a-zA-Z][0-9a-zA-Z._\@+-]*$);  # very simple pattern
 # same as REPONAME, plus some common regex metas
 $REPOPATT_PATT=qr(^\@?[0-9a-zA-Z][\\^.$|()[\]*+?{}0-9a-zA-Z._\@/-]*$);
 
diff --git a/src/gl-auth-command b/src/gl-auth-command
index b9e6359..c5b78ae 100755
--- a/src/gl-auth-command
+++ b/src/gl-auth-command
@@ -23,9 +23,8 @@ use warnings;
 #       common definitions
 # ----------------------------------------------------------------------------
 
-
 # these are set by the "rc" file
-our ($GL_LOGT, $GL_CONF_COMPILED, $REPO_BASE, $GIT_PATH, $GL_ADMINDIR);
+our ($GL_LOGT, $GL_CONF_COMPILED, $REPO_BASE, $GIT_PATH, $REPO_UMASK, $GL_ADMINDIR);
 # and these are set by gitolite.pm
 our ($R_COMMANDS, $W_COMMANDS, $REPONAME_PATT);
 our %repos;
@@ -39,13 +38,29 @@ require "$bindir/gitolite.pm";
 &where_is_rc();
 die "parse $ENV{GL_RC} failed: "       . ($! or $@) unless do $ENV{GL_RC};
 
+# we need to pass GL_ADMINDIR and the bindir to the child hooks (well only the
+# admin repo's post-update hook but still...)
+$ENV{GL_ADMINDIR} = $GL_ADMINDIR;
+$ENV{GL_BINDIR} = $bindir;
+
 # add a custom path for git binaries, if specified
 $ENV{PATH} .= ":$GIT_PATH" if $GIT_PATH;
 
+# set the umask before creating any files
+umask($REPO_UMASK);
+
 # ----------------------------------------------------------------------------
 #       start...
 # ----------------------------------------------------------------------------
 
+# if the first argument is a "-s", this user is allowed to get a shell using
+# this key
+my $shell_allowed = 0;
+if ($ARGV[0] eq '-s') {
+    $shell_allowed = 1;
+    shift;
+}
+
 # first, fix the biggest gripe I have with gitosis, a 1-line change
 my $user=$ENV{GL_USER}=shift;       # there; now that's available everywhere!
 
@@ -53,8 +68,14 @@ my $user=$ENV{GL_USER}=shift;       # there; now that's available everywhere!
 #       sanity checks on SSH_ORIGINAL_COMMAND
 # ----------------------------------------------------------------------------
 
-# SSH_ORIGINAL_COMMAND must exist; if not, we die with a nice message
+# print basic access info if SSH_ORIGINAL_COMMAND does not exist
 unless ($ENV{SSH_ORIGINAL_COMMAND}) {
+    # unless the user is allowed to use a shell
+    if ($shell_allowed) {
+        my $shell = $ENV{SHELL};
+        $shell =~ s/.*\//-/;    # change "/bin/bash" to "-bash"
+        exec { $ENV{SHELL} } $shell;
+    }
     &report_basic($GL_ADMINDIR, $GL_CONF_COMPILED, $user);
     exit 1;
 }
@@ -87,6 +108,12 @@ if ($cmd =~ $CUSTOM_COMMANDS) {
     exit 1;
 }
 
+# people allowed to get a shell can get basic access info by asking nicely
+if ($shell_allowed and $cmd eq 'info') {
+    &report_basic($GL_ADMINDIR, $GL_CONF_COMPILED, $user);
+    exit 1;
+}
+
 # ----------------------------------------------------------------------------
 #       normal (git) processing
 # ----------------------------------------------------------------------------
@@ -100,9 +127,12 @@ if ($cmd =~ $CUSTOM_COMMANDS) {
 # including the single quotes
 
 my ($verb, $repo) = ($cmd =~ /^\s*(git\s+\S+|\S+)\s+'\/?(.*?)(?:.git)?'/);
-die "bad command: $cmd.  Make sure the repo name is exactly as in your config\n"
-    unless ( $verb and ( $verb =~ $R_COMMANDS or $verb =~ $W_COMMANDS )
-        and  $repo and   $repo =~ $REPONAME_PATT );
+unless ( $verb and ( $verb =~ $R_COMMANDS or $verb =~ $W_COMMANDS ) and $repo and $repo =~ $REPONAME_PATT ) {
+    # if the user is allowed a shell, just run the command
+    exec $ENV{SHELL}, "-c", $ENV{SSH_ORIGINAL_COMMAND} if $shell_allowed;
+    # otherwise, whine
+    die "bad command: $cmd\n";
+}
 die "$repo ends with a slash; I don't like that\n" if $repo =~ /\/$/;
 die "$repo has two consecutive periods; I don't like that\n" if $repo =~ /\.\./;
 
diff --git a/src/gl-compile-conf b/src/gl-compile-conf
index 50dedba..9da28ed 100755
--- a/src/gl-compile-conf
+++ b/src/gl-compile-conf
@@ -82,8 +82,9 @@ $ENV{PATH} .= ":$GIT_PATH" if $GIT_PATH;
 # ----------------------------------------------------------------------------
 
 # command and options for authorized_keys
-$AUTH_COMMAND="$GL_ADMINDIR/src/gl-auth-command";
-$AUTH_OPTIONS="no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty";
+$AUTH_COMMAND="$bindir/gl-auth-command";
+$AUTH_OPTIONS="no-port-forwarding,no-X11-forwarding,no-agent-forwarding";
+    # note, for most users there's also a "no-pty" added to this, see later
 
 # groups can now represent user groups or repo groups.
 
@@ -483,7 +484,11 @@ for my $pubkey (glob("*"))
     print STDERR "WARNING: pubkey $pubkey exists but user $user not in config\n"
         unless $user_list{$user};
     $user_list{$user} = 'has pubkey';
-    print $newkeys_fh "command=\"$AUTH_COMMAND $user\",$AUTH_OPTIONS ";
+    if ($groups{'@SHELL'}{$user}) {
+        print $newkeys_fh "command=\"$AUTH_COMMAND -s $user\",$AUTH_OPTIONS ";
+    } else {
+        print $newkeys_fh "command=\"$AUTH_COMMAND $user\",$AUTH_OPTIONS,no-pty ";
+    }
     # apparently some pubkeys don't end in a newline...
     my $pubkey_content = `cat $pubkey`;
     $pubkey_content =~ s/\s*$/\n/;
diff --git a/src/gl-easy-install b/src/gl-easy-install
index db20e2f..b74621a 100755
--- a/src/gl-easy-install
+++ b/src/gl-easy-install
@@ -48,7 +48,7 @@ main() {
     [[ $upgrade == 0 ]] && initial_conf_key
 
     # MANUAL: cd to $GL_ADMINDIR and run "src/gl-compile-conf"
-    ssh -p $port $user@$host "cd $GL_ADMINDIR; src/gl-compile-conf $quiet"
+    ssh -p $port $user@$host "cd $GL_ADMINDIR; \$PWD/src/gl-compile-conf $quiet"
 
     setup_pta
 
@@ -361,6 +361,7 @@ run_install() {
 # MANUAL: setup the initial config file.  Edit $GL_ADMINDIR/conf/gitolite.conf
 # and add at least the following lines to it:
 
+#   @SHELL = sitaram
 #   repo gitolite-admin
 #       RW+                 = sitaram
 
@@ -368,6 +369,8 @@ initial_conf_key() {
     echo "#gitolite conf
 # please see conf/example.conf for details on syntax and features
 
+@SHELL                  = $admin_name
+
 repo gitolite-admin
     RW+                 = $admin_name
 
diff --git a/src/gl-install b/src/gl-install
index a4dc729..9494fc6 100755
--- a/src/gl-install
+++ b/src/gl-install
@@ -79,8 +79,6 @@ for my $repo (`find . -type d -name "*.git"`) {
 if ( -d "gitolite-admin.git/hooks" ) {
     print "copying post-update hook to gitolite-admin repo...\n";
     system("cp $GL_ADMINDIR/src/ga-post-update-hook gitolite-admin.git/hooks/post-update");
-    system("perl", "-i", "-p", "-e", "s(GL_ADMINDIR=.*)(GL_ADMINDIR=$GL_ADMINDIR)",
-        "gitolite-admin.git/hooks/post-update");
     chmod 0755, "gitolite-admin.git/hooks/post-update";
 }