0

When deploying my Subversion server, I don't like creating a system account for each user so I was thinking of another authentication method.

I would like to use only one system account with SSH and then authenticate users using svnserve.

I tried to configure SSH so that each user has a different key and a specific svnserve command with a specific --tunnel-user. I also added these users into my passwd file in my repository.

My problem is that svnserve does not use the passwd file to authenticate --tunnel-user names but allows to read and write as long as the SSH authentication has been done.

Is there a way to force svnserve to prevent a user not in passwd from reading or commiting in a repository?

Edited:

If there is no way to achieve this with my setup, is there another way to serve Subversion on SSH without creating a system account for each user?

2 Answers 2

1

Tunnel mode skips svnserve authentication in favor of SSH authentication by design.

"... the connection is considered to be pre-authenticated ..."

You're trying to bend this approach into doing what it's not meant to do. How about using a WebDAV setup over SSL (with users defined in the web server's authentication) instead?

2
  • Thanks for the info about SSH authentication skipping svnserve authentication, I now understand why my setup does not work. About your suggestion of using HTTPS, I considered it but I would rather use a key-based authentication that I consider more secure and easier to maintain. Any other idea how I could serve Subversion on SSH without creating a system account for each user? Oct 28, 2011 at 8:36
  • 1
    You could use key based authentication with WebDAV. You will still need some kind of authentication server, and configure your web server to use certificate based authentication.
    – dunxd
    Oct 28, 2011 at 9:25
0

I found a simple solution. While svnserve cannot do the authentication again with an SSH-authenticated user, it still can authorize it using the authz file.

So here is my setup:

  • user svn is the main account and its home is /var/svn
  • all users use svn account to SSH on the SVN server
  • svn account has every public keys of every users in its .ssh/authorized_keys
  • each public key is prefixed with command="svnserve -r /var/svn -t --tunnel-user=<user1>" (it is actually longer because I also disable tunnelling and co.)
  • each repository in /var/svn has authz-db = authz in conf/svnserve.conf
  • each repository has its own conf/authz file to list authorized users:
[groups]
developers = <user1>,<user2>

[/]
@developers = rw
* =

Now I can add a user by simply adding a new public key in /var/svn/.ssh/authorized_keys with a new --tunnel-user name and add this user name to all authorized repositories.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .