Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Basically, how do I do it?

Currently I've configured the Location in Apache to require SSL, use basic auth, and require valid-user. That's a bit much, as I want to allow anonymous pull, just require basic auth for the pushers — right now user/password are required to simply view the repository in a web browser. I'd like to require SSL at all times, and don't really want to host the same repository twice (to have a different Location for the pull-only, and another for the verified push).

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

Ches Martin has a nice blog with details of how he setup Mercurial complete with what you are asking.

<LimitExcept GET>
  require valid-user
</LimitExcept>

This snippet from an Apache config is part of what is needed to allow anonymous pull (or browsing if published via hgweb) but still require a pass for push.

share|improve this answer
add comment

What you looking for is may be the LimitExcept directive of Apache. Something like:

<LimitExcept GET>
  Require valid-user
</LimitExcept>

So that a user/pass will be needed for anything else than a GET request. But I don't know Mercurial and don't know how hg push is done. If it is a POST request, it will be Ok, but may be that POST is also required to pull.

share|improve this answer
    
Mercurial only uses POST for hg push, so you're correct in your suggestions. –  Martin Geisler Dec 18 '11 at 10:42
add comment

You're making your problem a lot harder by requiring SSL for the anonymous pull, and I have no idea what you're aiming for by doing so. If anyone can pull without authentication, anyone can see all of the data just by asking, making sniffing the wire completely redundant, so there's no point in encrypting it.

I strongly recommend taking the simpler route of putting your anonymous distribution on http, and save https for pushes.

share|improve this answer
1  
The whole subdomain is https only- there are other repositories and information that requires authorized users + ssl. We decided to deny plain http so that there wouldn't be any confusion or security holes. –  user9748 Jul 5 '09 at 17:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.