Subversion and external collaborators: HTTPS vs. VPN

Question

We are currently having some issues with VPN connections. The whole thing slows down development and reaction time. What I was used to in my previous workplace was using SSH for accessing FTP and HTTPS for self-hosted Subversion.

In real world production environments: how often do you use VPN instead of HTTPS for accessing Subversion repositories by external employees? If you do, was security the main concern?

Answer 1

We run SSL on our subversion repositories for external access, simply because it's just so much easier than VPNs to:

• Maintain (there is no maintanance)
• Set up (takes about 10 minutes)
• Configure clients (None needed)
• 100% compatibility guaranteed (No funky VPN clients)
• Cross-platform
• Much more secure (No chance of forgetting to set a firewall rule and opening up your entire network)
• No need for SSH (great for Windows clients)

Answer 2

I use svn+ssh basically everyhwere. For people who don't ever need to run anything but svn on the server, you can prepend something like this to the front of their ~/.ssh/authorized_keys:

command="svnserve -t --tunnel-user=theuser",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty

This does mean that your users need to use public key auth, but hey that's not a bad thing, right?

Answer 3

Both https and a VPN create an SSL tunnel, using both is redundant. Use a VPN if you need to give the collaborators access to other network resources, like a file share.

At work we use HTTPS with a certificate that costs us $30 per year. I highly recommend using a CA as it thwarts MITM attacks.