up vote 1 down vote favorite
share [g+] share [fb]

I'd like to setup Subversion repository so that same username and password could be used to access repository as in ssh login. I managed to get login work so that correct username is required, but it accepts any password. How I can get it to require valid password also?

I'm running Ubuntu server 8.04.2 with "standard modules", Apache2, Subversion and libapache2-mod-authnz-external. In addition I found utility called pwauth to help with authentication.

Here are the relevant parts from configuration:

/etc/apache/apache2.conf

AddExternalAuth pwauth /usr/local/bin/pwauth
SetExternalAuthMethod pwauth pipe
AddExternalGroup unixgroup /usr/local/bin/unixgroup
SetExternalGroupMethod unixgroup environment

/etc/apache/mods-available/dav_svn.conf:

AuthType Basic
AuthBasicProvider external
AuthExternal pwauth
GroupExternal unixgroup
AuthName "Subversion repository"
Require group users
Require user myaccount

/etc/pam.d/pwauth:

auth    required        pam_succeed_if.so user=www-data
account required        pam_localuser.so

config.h for pwauth:

#define PAM                     /* Linux PAM or OpenPAM*/
#define UNIX_LASTLOG            /**/
#define HAVE_LASTLOG_H          /**/
#define NOLOGIN_FILE "/etc/nologin"     /**/
#define MIN_NOLOGIN_UID 1               /**/
#define CHECK_LOGIN_EXPIRATION          /**/
#define CHECK_PASSWORD_EXPIRATION       /**/
#define SERVER_UIDS 33          /* user "www-data" */
#define MIN_UNIX_UID 500        /**/
#define SLEEP_LOCK "/var/run/pwauth.lock"

(is something missing?)

Edit: I'm aware about potential security issues, but I want know why this setup doesn't work.

link|improve this question
feedback

3 Answers

up vote 3 down vote

I have set this up before, and the way subversion works it would prompt you for your passwords hundreds of times during a session.

(To do this, simply connect your subversion client to svn+ssh://username@servername/path/to/repo)

The answer is to use ssh keys.

Set up your private/public key pair, and upload your public key to your ~/.ssh/authorized_keys file, but prefix it with "command="/usr/bin/svnserve -t -r /path/to/repo"

And connect again using svn+ssh as mentioned above

link|improve this answer
1  
TortoiseSVN remembers the authentication information. Not the safest solution, but ok for current use. – Harriv Jun 10 '09 at 20:44
Yeah, but SSH keys give better security with less hassle, once set up. – David Thornley Jun 10 '09 at 21:55
1  
Bad idea to use svn+ssh for a multi-user setup, it will create you a lot of trouble with permissions (for instance, files created by one user won't be modifiable by the others, depending on the umask). See "The svn+ssh:// Server Checklist" in svnbook.red-bean.com/en/1.5/svn.serverconfig.multimethod.html – bortzmeyer Jun 11 '09 at 13:13
Good point - I remember we had to do a bit of permissions tweaking when we first set this up. – Brent Jun 11 '09 at 15:00
When using command="/usr/bin/svnserve -t -r /path/to/repo" the user/key combination is bound to one repo, is there a secure way to allow the same user to access multiple repos? – Mene Apr 13 '11 at 16:00
feedback
up vote 0 down vote

avoid apache altogether and use svn+ssh protocol

link|improve this answer
Bad idea, it will create you a lot of trouble with permissions (for instance, files created by one user won't be modifiable by the others, depending on the umask). See "The svn+ssh:// Server Checklist" in svnbook.red-bean.com/en/1.5/svn.serverconfig.multimethod.html – bortzmeyer Jun 11 '09 at 13:13
feedback
up vote 0 down vote

Don't do that. Do not use login passwords in potentially less secure applications. Use ssh keys like Brent says.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.