3

I am configuring the server SVN Collabnet (v1.5.6.1 for Solaris 10). I succeeded to use the ldap server for SVN authentication. How avoid to write a non encrypted password (XXXXX, here) in the following configuration file (collabnet_subversion_httpd.conf)?

ServerName mccuatsv10:8080
Listen 8080

User csvn

Group csvn

<Location /svn>
  DAV svn
  SetHandler svn
  SVNParentPath /appli/svn/repositories/
  AuthName "Subversion repository"
  AuthType Basic
  AuthBasicProvider ldap
  AuthzLDAPAuthoritative On
  AuthLDAPBindDN [email protected]
  AuthLDAPBindPassword XXXXX
  AuthLDAPURL ldap://eur.msd.world.ibm:389/OU=Users,OU=Accounts,OU=FR,DC=eur,DC=msd,DC=world,DC=socgen?sAM
AccountName?sub?(objectCategory=person)
  Require valid-user
</Location>

4 Answers 4

6

One option is to put the AuthLDAPBindPassword line in an appropriately chmodded file on its own, and use an Include in the apcahe config to pull that file in. i.e.:

<Location /svn>
   ...
   AuthLDAPBindDN [email protected]
   Include my_ldap_password.conf
   ...
</Location>

This keeps the password secure, while leaving the rest of the config world readable.

2
  • I strongly feel like there is a password file you can specify for LDAP auth, or am I remembering (incorrectly) the samba.conf for LDAP config? Memory is failing, need more RAM!
    – geoffc
    Jun 18, 2009 at 2:22
  • > One option is to put the AuthLDAPBindPassword line in an appropriately chmodded file on its own, and use an Include in the apcahe config to pull that file in I tried this and it didn't work. The Apache manual says that the Include directive is only allowed within the main body, Virtual Host, or Directory directives; the example above uses a Location directive (e.g. a proxy) and the Include always generates an error when Apache reads the included file.
    – user71097
    Feb 17, 2011 at 4:44
2

some ldap servers allow anonymous binding. then [ afaik ] you dont need to provide bind password.

1
  • beside 15, cannot vote up but thanks a lot Here, our ldap server does not allow anonymous binding Jun 17, 2009 at 15:40
0

Since Apache2 starts as root and reads config file before dropping root.

Assuming your current file config is owned by root and group is root, like so:

-rw-r--r-- 1 root root 1.4K 2014-10-15 14:43 vhostconf

You can just drop read/write/execute from the file to "other users":

sudo chmod o-rwx /etc/apache2/sites-available/vhostconf

You should end up with:

-rw-r----- 1 root root 1.4K 2014-10-15 14:43 vhostconf

This should be enough permissions for Apache2 to read it.

0

Starting with Apache 2.2.25, AuthLDAPBindPassword can execute a command to find the password.

The simplest option would be to have

AuthLDAPBindPassword "exec:/bin/cat /some/file/with/password"

Details in http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html#authldapbindpassword

1
  • When testing this on Apache/2.4.46 it worked fine in the beginning, but was accumulating defunct cat processes in the background until it suddenly stopped working. A restart of apache fixed it temporarily. That's probably related to an apache issue reported in 2017: bz.apache.org/bugzilla/show_bug.cgi?id=61817
    – MaPePeR
    Oct 19, 2020 at 7:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .