Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When deploying my Subversion server, I don't like creating a system account for each user so I was thinking of another authentication method.

I would like to use only one system account with SSH and then authenticate users using svnserve.

I tried to configure SSH so that each user has a different key and a specific svnserve command with a specific --tunnel-user. I also added these users into my passwd file in my repository.

My problem is that svnserve does not use the passwd file to authenticate --tunnel-user names but allows to read and write as long as the SSH authentication has been done.

Is there a way to force svnserve to prevent a user not in passwd from reading or commiting in a repository?

Edited:

If there is no way to achieve this with my setup, is there another way to serve Subversion on SSH without creating a system account for each user?

share|improve this question
add comment

2 Answers

Tunnel mode skips svnserve authentication in favor of SSH authentication by design.

"... the connection is considered to be pre-authenticated ..."

You're trying to bend this approach into doing what it's not meant to do. How about using a WebDAV setup over SSL (with users defined in the web server's authentication) instead?

share|improve this answer
    
Thanks for the info about SSH authentication skipping svnserve authentication, I now understand why my setup does not work. About your suggestion of using HTTPS, I considered it but I would rather use a key-based authentication that I consider more secure and easier to maintain. Any other idea how I could serve Subversion on SSH without creating a system account for each user? –  Vincent Robert Oct 28 '11 at 8:36
1  
You could use key based authentication with WebDAV. You will still need some kind of authentication server, and configure your web server to use certificate based authentication. –  dunxd Oct 28 '11 at 9:25
add comment
up vote 0 down vote accepted

I found a simple solution. While svnserve cannot do the authentication again with an SSH-authenticated user, it still can authorize it using the authz file.

So here is my setup:

  • user svn is the main account and its home is /var/svn
  • all users use svn account to SSH on the SVN server
  • svn account has every public keys of every users in its .ssh/authorized_keys
  • each public key is prefixed with command="svnserve -r /var/svn -t --tunnel-user=<user1>" (it is actually longer because I also disable tunnelling and co.)
  • each repository in /var/svn has authz-db = authz in conf/svnserve.conf
  • each repository has its own conf/authz file to list authorized users:
[groups]
developers = <user1>,<user2>

[/]
@developers = rw
* =

Now I can add a user by simply adding a new public key in /var/svn/.ssh/authorized_keys with a new --tunnel-user name and add this user name to all authorized repositories.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.