Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to setup Subversion repository so that same username and password could be used to access repository as in ssh login. I managed to get login work so that correct username is required, but it accepts any password. How I can get it to require valid password also?

I'm running Ubuntu server 8.04.2 with "standard modules", Apache2, Subversion and libapache2-mod-authnz-external. In addition I found utility called pwauth to help with authentication.

Here are the relevant parts from configuration:

/etc/apache/apache2.conf

AddExternalAuth pwauth /usr/local/bin/pwauth
SetExternalAuthMethod pwauth pipe
AddExternalGroup unixgroup /usr/local/bin/unixgroup
SetExternalGroupMethod unixgroup environment

/etc/apache/mods-available/dav_svn.conf:

AuthType Basic
AuthBasicProvider external
AuthExternal pwauth
GroupExternal unixgroup
AuthName "Subversion repository"
Require group users
Require user myaccount

/etc/pam.d/pwauth:

auth    required        pam_succeed_if.so user=www-data
account required        pam_localuser.so

config.h for pwauth:

#define PAM                     /* Linux PAM or OpenPAM*/
#define UNIX_LASTLOG            /**/
#define HAVE_LASTLOG_H          /**/
#define NOLOGIN_FILE "/etc/nologin"     /**/
#define MIN_NOLOGIN_UID 1               /**/
#define CHECK_LOGIN_EXPIRATION          /**/
#define CHECK_PASSWORD_EXPIRATION       /**/
#define SERVER_UIDS 33          /* user "www-data" */
#define MIN_UNIX_UID 500        /**/
#define SLEEP_LOCK "/var/run/pwauth.lock"

(is something missing?)

Edit: I'm aware about potential security issues, but I want know why this setup doesn't work.

share|improve this question

3 Answers 3

I have set this up before, and the way subversion works it would prompt you for your passwords hundreds of times during a session.

(To do this, simply connect your subversion client to svn+ssh://username@servername/path/to/repo)

The answer is to use ssh keys.

Set up your private/public key pair, and upload your public key to your ~/.ssh/authorized_keys file, but prefix it with "command="/usr/bin/svnserve -t -r /path/to/repo"

And connect again using svn+ssh as mentioned above

share|improve this answer
1  
TortoiseSVN remembers the authentication information. Not the safest solution, but ok for current use. –  Harriv Jun 10 '09 at 20:44
    
Yeah, but SSH keys give better security with less hassle, once set up. –  David Thornley Jun 10 '09 at 21:55
1  
Bad idea to use svn+ssh for a multi-user setup, it will create you a lot of trouble with permissions (for instance, files created by one user won't be modifiable by the others, depending on the umask). See "The svn+ssh:// Server Checklist" in svnbook.red-bean.com/en/1.5/svn.serverconfig.multimethod.html –  bortzmeyer Jun 11 '09 at 13:13
    
Good point - I remember we had to do a bit of permissions tweaking when we first set this up. –  Brent Jun 11 '09 at 15:00
    
When using command="/usr/bin/svnserve -t -r /path/to/repo" the user/key combination is bound to one repo, is there a secure way to allow the same user to access multiple repos? –  Mene Apr 13 '11 at 16:00

Don't do that. Do not use login passwords in potentially less secure applications. Use ssh keys like Brent says.

share|improve this answer

avoid apache altogether and use svn+ssh protocol

share|improve this answer
    
Bad idea, it will create you a lot of trouble with permissions (for instance, files created by one user won't be modifiable by the others, depending on the umask). See "The svn+ssh:// Server Checklist" in svnbook.red-bean.com/en/1.5/svn.serverconfig.multimethod.html –  bortzmeyer Jun 11 '09 at 13:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.