Best practice to share or allow access to trac and svn to wan internet users security?

Question

What is considered best practice for sharing or allowing users from the internet that are not company related to have access to trac and svn?

Should it be on a DMZ, should it be internal with some form of SSH connection or using an https?

If you were to do it and be paranoid of security what should be the best practice list assuming basic firewall on the WAN, should the server be on its own leg on the network like a perimeter zone (away from internal users too, double firewalled).

thanks in advance.

Answer 1

assuming you are paranoid indeed [ aka overkill scenario ]:

1. put a reverse proxy [eg using apache2] in firewalled subnet, make it accessible only via https, only from selected ip address of external users who need to access it [ this protects you against blind attacks on possible vulnerabilities in apache / svn / trac ]. forward on it only requests to valid urls [ eg /svn and /trac ] to actual server located in separate subnet. make sure this proxy can reach only your actual server, only on port 80/tcp. nothing else.
2. put your actual svn / trac server in separate subnet, with controlled access: allow incoming http connections from inside your company and from the proxy. disallow outgoing connections.

if limiting access to #1 to explicitly list ip ranges is not an option - consider some form of gatekeeper - again - to avoid blind attacks.

at the proxy level - consider using:

• modsecurity to avoid for instance sql injection/xss attacks on trac,
• fail2ban to make dictionary attacks on authentication mechanism of svn / trac a bit harder.

Answer 2

depends what your budget is.

try with a firewall in front allowing only https access and with two way ssl on apache side of things.

Answer 3

If I were doing it, I'd put trac on a box outside the main corporate firewall but put in firewall rules on it to block access to anything but ssh (for me) and http (for everyone else).

Another option might be to ask yourself: should we be hosting this at all? Would it work better at sourceforge or savannah.{non}gnu.org or github ?

Answer 4

Standard server with https access only is pretty secure solution with limited number of open ports, etc.

Paranoid configuration could be VPN (for example openvpn) access for users outside of company. Trac and svn would only be accessible from your private network and from VPN. User access to VPN would be secured by certificates issued by you. And of course no other server and internal network would be accessible from VPN.

This solution is of course only possible if the set of people from outside of company is pretty stable and not too big. If number of those users and specific people change then the first soultion with https access and good setup firewall is rally the only one (and used by a lot of people and companies).