Introduction
Introduction Statistics Contact Development Disclaimer Help
### Switching SVN authentication from clear-text to ssh+svn ###
SVN is a truly awesome beast when it comes to keeping track of any software
development (yes, I know kids these days prefer git - probably because it's
more "cool" for some reason. I don't care. I use svn).
But to the point. SVN is an extraordinary tool, but unfortunately, it doesn't
come with native support for any form of encryption nor serious
authentication. I know two solutions to this shortcoming:
a) funnel all svn operations into an (SSL-enabled) apache web server, relying
on its webdav extension.
b) tunnel all svn operations through a SSH tunnel
I shortly investigated option a) and quickly came to the conclusion that I do
not like it. Too much of a mess, too much (apache) overhead, having to trust a
wonky http extension (webdav)... Other people may disagree - but I let them
have the fun with the apache/ssl/webdav contraption.
My choice is to go the SSH route. SSH is a perfectly standard, extremely
secure and very lightweight protocol. Plus, the vast majority of SVN clients
know how to talk svn-over-ssh.
How?
First thing - I do not want subversion to listen on a raw TCP socket any more.
On most Linux distributions, subversion is pre-configured through either inetd
or xinetd. This needs to be removed (check with 'netstat -antp' to make sure
it does not listen any more).
Then, create a system user that will accept svn queries and relay them to the
local 'svnserve' binary. Let's call this user "svnuser" for the sake of
simplicity. All (actual) svn users will need to authenticate as 'svnuser', but
without any rights that could allow them to fiddle with the system. This can
be set up through a proper authorized_keys file, as shown in the example
below.
/home/svnuser/.ssh/authorized_keys:
command="/usr/bin/svnserve -t -r /srv/svn --tunnel-user=mateusz",no-port-forw
arding,no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAA
AABIwAAAQEAykx+2hO8kBxdUAeLuL5eNgEnNWh8aWA3tkg6qPMMZWliuvrNSe7plp6RliKgmLIOVx
TC1OqE7B+MHWaHS/y0hOxDVwfLTtvUFd+IgmGwc4MwDOqOSohQdlaOph3Rs2b3PUrVzG73d0tztu7
NVyfoZ3V13NIp1GZnptZOak910FpoiBDVMShiJr8rb4K5JIgUb6h+BRFf8pXoGIU75zEnbGlA+64l
3cFGBRRitzXUHGPfMtFSndyJ1MV2M6vfo2A6DYaa/YGVTBMqQTvP4am7zITO6DKjzxifLI62HP6c6
9u/Q== Mateusz
The above line will allow me to authenticate as 'svnuser' using my ssh key,
and execute svnserve feeding it with a virtual user named 'mateusz'.
Basically, the ssh system will see 'svnuser' authenticating, while svn will
see 'mateusz' doing svn operations.
now use:
svn checkout svn+ssh://svnuser@svnserver/project
It is worth noting that all passwords declared in the svn configuration
(conf/passwd) become meaningless, since they won't be ever used anyway.
A variant of this configuration is to create separate system users for each
and every svn user. The principle is strictly the same, it's just more work
each time a new svn user needs to be added.
You are viewing proxied material from gopher.viste.fr. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.