Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am configuring the server SVN Collabnet (v1.5.6.1 for Solaris 10). I succeeded to use the ldap server for SVN authentication. How avoid to write a non encrypted password (XXXXX, here) in the following configuration file (collabnet_subversion_httpd.conf)?

ServerName mccuatsv10:8080
Listen 8080

User csvn

Group csvn

<Location /svn>
  DAV svn
  SetHandler svn
  SVNParentPath /appli/svn/repositories/
  AuthName "Subversion repository"
  AuthType Basic
  AuthBasicProvider ldap
  AuthzLDAPAuthoritative On
  AuthLDAPBindDN christian.desbordes@ibm.com
  AuthLDAPBindPassword XXXXX
  AuthLDAPURL ldap://eur.msd.world.ibm:389/OU=Users,OU=Accounts,OU=FR,DC=eur,DC=msd,DC=world,DC=socgen?sAM
AccountName?sub?(objectCategory=person)
  Require valid-user
</Location>
share|improve this question

3 Answers 3

One option is to put the AuthLDAPBindPassword line in an appropriately chmodded file on its own, and use an Include in the apcahe config to pull that file in. i.e.:

<Location /svn>
   ...
   AuthLDAPBindDN christian.desbordes@ibm.com
   Include my_ldap_password.conf
   ...
</Location>

This keeps the password secure, while leaving the rest of the config world readable.

share|improve this answer
    
I strongly feel like there is a password file you can specify for LDAP auth, or am I remembering (incorrectly) the samba.conf for LDAP config? Memory is failing, need more RAM! –  geoffc Jun 18 '09 at 2:22
    
> One option is to put the AuthLDAPBindPassword line in an appropriately chmodded file on its own, and use an Include in the apcahe config to pull that file in I tried this and it didn't work. The Apache manual says that the Include directive is only allowed within the main body, Virtual Host, or Directory directives; the example above uses a Location directive (e.g. a proxy) and the Include always generates an error when Apache reads the included file. –  user71097 Feb 17 '11 at 4:44

some ldap servers allow anonymous binding. then [ afaik ] you dont need to provide bind password.

share|improve this answer
    
beside 15, cannot vote up but thanks a lot Here, our ldap server does not allow anonymous binding –  taintedlove Jun 17 '09 at 15:40

Since Apache2 starts as root and reads config file before dropping root.

Assuming your current file config is owned by root and group is root, like so:

-rw-r--r-- 1 root root 1.4K 2014-10-15 14:43 vhostconf

You can just drop read/write/execute from the file to "other users":

sudo chmod o-rwx /etc/apache2/sites-available/vhostconf

You should end up with:

-rw-r----- 1 root root 1.4K 2014-10-15 14:43 vhostconf

This should be enough permissions for Apache2 to read it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.