14

Currently I am using VisualSVN Server and it's only accessible on my home network. Eventually there will be others accessing it, but for now it's just me and I would like to be able to go down to the coffee shop (or wherever) and be able to work away from the house.

Currently I'm accessing the server at http://user-pc:xx/svn/Projects/. When I setup my router to forward port XX to my server, what steps should I take to secure the server?

Keep in mind that I am doing this on Windows and while I use the regular command prompt extensively, I haven't been on SVN very long and haven't used anything other than TortoiseSVN to work with it up to this point.

Edit: The only harmful thing an attacker could do, that I'm aware of, is to: guess my port number, username, and password to get into the repository. However as the saying goes, I don't know what I don't know.

So I'm not necessarily asking for step by step instructions (although I would certainly like to have that too) as much as what things I need to keep in consideration for any kind of attack that could be made once the port is open.

5
  • Can you define, what is "to protect myself?" for you? Protect your code, your Apache, your Windows from script-kiddies? Nov 20, 2011 at 3:17
  • @LazyBadger See my edit
    – Brandon Moore
    Nov 20, 2011 at 3:37
  • To answer the question you left in the flag, the SO close-voters didn't think this question deserved any more attention. They felt it was clearly off topic (like it is here, it's about a home server which is off topic) and didn't want to spend the time to explain again why, forgetting that for each occurrence it is someone's first time. I'm not a regular on SO so can't explain what their on/off topic thinking was.
    – sysadmin1138
    Nov 20, 2011 at 21:31
  • @sysadmin1138 Thanks for actually taking the time to write. I don't know what you mean by spending time to explain 'again' though since they never explained anything to begin with. I agree it seems off topic here, however it was not off topic at Stack Overflow and I would still love an explanation about that. I suspect there's not one though, and that they just arbitrarily decided they didn't like the question. Nov 20, 2011 at 21:44
  • I left a flag on the SO question to see if I can get this shifted to a better home.
    – sysadmin1138
    Nov 20, 2011 at 21:45

3 Answers 3

7
  1. Use good password strength to secure the VisualSVN server
  2. Use a higher port for the server e.g. 39517 instead of the default port 80 or 443. Makes it harder for an attacker to guess. The attacker would have to rely on a port scan.
  3. VisualSVN server will not allow anonymous access. You need to explicitly define users.
  4. Give user access only to people you know/trust.
9
  • 1
    Shouldn't it be 4. Give user access only to people you trust ( don't let them use your account )
    – orn
    Nov 20, 2011 at 1:48
  • Given his #3, that's what I kind of assumed he meant.
    – Brandon Moore
    Nov 20, 2011 at 1:50
  • @orn, that is what I mean. Sorry for my English.
    – desaivv
    Nov 20, 2011 at 2:10
  • One thing I wondered about was brute force attempts to hack a password, but I forget they would have to guess the username as well so that's good.
    – Brandon Moore
    Nov 20, 2011 at 2:12
  • @BrandonMoore they would also need to know the port.
    – desaivv
    Nov 20, 2011 at 2:15
8
  1. Use https on server side, not plain http (AuthType Basic is interceptable) of use Digest auth (have to configure Apache by hand)
  2. Use (free) CA-issued cert on server, not self-signed (you can use self-signed cert, but will have (?) to verify it by eye every time)
  3. Maintain up-to-date VisualSVN Server version (with fixes for possible problems in Apache and|or SVN itself)
  4. Enable logging in httpd.conf for security-audit (no logging by default in VisualSVN Server)
0

I would recommend using ssh access to your svn server. I personally prefer public/private key authentication.

Even with that, desaivv's suggestions are also things that I would recommend.

11
  • Thanks Robert. In my google searches that's what I've found everyone says... but I haven't yet found any simple instructions on doing it with VisualSVN. Eventually I will learn about this stuff but in the meantime if you think you know of a laymen's guide to setting up ssh that might be simpler than the ones I've come across I would love to see it.
    – Brandon Moore
    Nov 20, 2011 at 3:57
  • For client configuration: visualsvn.com/support/topic/00008
    – robertvoliva
    Nov 20, 2011 at 4:00
  • 1
    @robertvoliva - VisualSVN Server is http/https access protocol only, for svn+ssh:// another solution must to be used Nov 20, 2011 at 4:28
  • 1
    @brandon-moore No, it's about ssh-tunnels from client (TortoiseSVN) to SSH-capable server, which is not VisualSVN Server Nov 20, 2011 at 4:43
  • 1
    VisualSVN (not server) is add-on for client-access to SVN-repo, protocol-agnostic, relied on existing svn-client. Support-forum have two separate main category, link from "VisualSVN" category, unrelated to server Nov 20, 2011 at 5:06

Not the answer you're looking for? Browse other questions tagged .