Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What is considered best practice for sharing or allowing users from the internet that are not company related to have access to trac and svn?

Should it be on a DMZ, should it be internal with some form of SSH connection or using an https?

If you were to do it and be paranoid of security what should be the best practice list assuming basic firewall on the WAN, should the server be on its own leg on the network like a perimeter zone (away from internal users too, double firewalled).

thanks in advance.

share|improve this question
    
i have setup trac and svn both on windows and linux, setting it up is not the problem it is just the security portion or if it gets hacked. –  user8256 Jan 28 '10 at 20:24

4 Answers 4

up vote 2 down vote accepted

assuming you are paranoid indeed [ aka overkill scenario ]:

  1. put a reverse proxy [eg using apache2] in firewalled subnet, make it accessible only via https, only from selected ip address of external users who need to access it [ this protects you against blind attacks on possible vulnerabilities in apache / svn / trac ]. forward on it only requests to valid urls [ eg /svn and /trac ] to actual server located in separate subnet. make sure this proxy can reach only your actual server, only on port 80/tcp. nothing else.
  2. put your actual svn / trac server in separate subnet, with controlled access: allow incoming http connections from inside your company and from the proxy. disallow outgoing connections.

if limiting access to #1 to explicitly list ip ranges is not an option - consider some form of gatekeeper - again - to avoid blind attacks.

at the proxy level - consider using:

  • modsecurity to avoid for instance sql injection/xss attacks on trac,
  • fail2ban to make dictionary attacks on authentication mechanism of svn / trac a bit harder.
share|improve this answer

depends what your budget is.

try with a firewall in front allowing only https access and with two way ssl on apache side of things.

share|improve this answer

If I were doing it, I'd put trac on a box outside the main corporate firewall but put in firewall rules on it to block access to anything but ssh (for me) and http (for everyone else).

Another option might be to ask yourself: should we be hosting this at all? Would it work better at sourceforge or savannah.{non}gnu.org or github ?

share|improve this answer
    
i thought the same thing, i would rather convince company to have it hosted and just keep backups of the data. –  user8256 Jan 28 '10 at 21:38

Standard server with https access only is pretty secure solution with limited number of open ports, etc.

Paranoid configuration could be VPN (for example openvpn) access for users outside of company. Trac and svn would only be accessible from your private network and from VPN. User access to VPN would be secured by certificates issued by you. And of course no other server and internal network would be accessible from VPN.

This solution is of course only possible if the set of people from outside of company is pretty stable and not too big. If number of those users and specific people change then the first soultion with https access and good setup firewall is rally the only one (and used by a lot of people and companies).

share|improve this answer
    
yes this is another alright solution but too much to roll out to another client or contract. if it was just for the one client it woudl be fine but it would be to support their other clients so things would end up getting messy. the reverse proxy approach actually allows you to use basic web browser. –  user8256 Feb 1 '10 at 2:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.