0

We plan to migrate our SVN server from LAN to Internet.

We need to convince our management, that our setup is secure enough.

Is there any SVN server security scanning tool, to check on the security level of our SVN server?

Thanks. We are using Windows.

2 Answers 2

3

There are no security tools specifically for this task, but with a little knowledge about your OS, Subversion and apache httpd, there is a lot you can do.

  1. Get management to write a security policy with you (define "secure enough") that covers how to deal with internet-facing code repositories. This policy or procedures should dictate how patching, initial configuration, daily management + backups, followup audits, etc are performed.
  2. Monitor CPU, RAM, disk space, disk i/o and network usage on your server and investigate any abnormalities.
  3. Backup your repository often. Svn's hot-copy should let you do backups at least daily or every hour.
  4. Scan your server with nmap and note which services are responding.
  5. Run netstat -an on your server and note which services are LISTENING.
  6. For each of the services you don't need for this particular task (e.g. Windows filesharing), disable them. Double-check afterwards with nmap or netstat that the service is gone.
  7. Create ways for your team to be notified about security bugs in your OS and each of the services you have exposed to the world. One option is to use vendor RSS feeds to create high priority tickets in your issue tracker when there are new security fixes available.
  8. Specifically for Apache httpd: It should be running with as few modules loaded as possible. If only trusted users should be able to read/write to your repository, require authentication for doing anything. Use https with certificates on both server and client.
  9. Now you can place your server on the internet.
  10. Regularly do audits to make sure the server still adheres to your security policy.

Maybe http://mongers.org/svnsec has some input for you as well.

0

Assuming you will be using HTTPS as the transport, I suggest you find a security scanner that can find flaws in the webserver of your choosing. I've yet to see any tools specific for Subversion repositories.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .