1

Let me first preface this by saying I know this is a personnel management issue, and I have no control over the personnel management issue. The personnel management issue is known to the client, but the will to modify it is not present. So I am in the position of seeking a technological fix to a management problem.

I have a client that has a subsidiary they bought from another company. That subsidiary does website coding in ColdFusion 8 for a federal agency. Currently they have a Dev and Test CF server. The dev staff are generally very new, and don't have much, if any, experience in using Source Control software. There is an admin account for the ColdFusion servers that is known to all devs. So we have a situation where devs will copy code directly from their machines to the Dev/Test servers without checking it into SVN. Obviously issues and hijinks ensue from this.

What I'm trying to do is lock down the IIS folder that ColdFusion references such that it can ONLY be updated from SVN - that is to say, users cannot copy or modify files in it except from within SVN.

As far as I know, it isn't possible, but I turn to you, great ServerFault gurus, to tell me if such a thing can be accomplished.

Improve this question
2

1 Answer 1

Reset to default
3

As long as the developers have local admin rights, they will be able to undo your lockdown of IIS folder permissions. The last thing you to start is a cyberwar within your own company: believe it or not, you are better off with a minor political battle if you are prepared to win it. Furthermore, you will win such a political battle, because you are on the winning side of the merger.

Therefore, your objective is to remove the developers' admin rights on the servers in question:

  1. Talk to the developers' boss or team lead. Make sure that he/she understands what you're doing and why. In turn, make sure that you understand everything that his/her team needs to be able to do with the development servers.
  2. Ensure that Subversion is running under an appropriately privileged service account whose password is unknown to the developers. ("Administrator" is not a service account.)
  3. Change the administrator password for the Dev and Test servers. Do not give the new password to the developers.
  4. Ensure that developers can check in code using SVN.
  5. Ensure that developers can run their tests using their own appropriately privileged user accounts which do not have access to write to the IIS folder.
  6. Come to an agreement about how these servers are to be maintained, particularly with respect to updates and patch management.
  7. When developers need administrative changes made to the server, be responsive, or they will demand their admin rights back.
Improve this answer
7
  • The problem is that devs are NOT checking their code into SVN - they're copying it manually to the IIS/CF folders willy nilly. This request was an attempt by management to force code check in without actually doing personnel management...
    – Driftpeasant
    Nov 2, 2011 at 20:45
  • Ergo, you must deny them administrative access to the server and ensure that their only means of pushing code to the server is via SVN. It won't necessarily be easy, but you definitely can win this battle. Being on the right side of a merger definitely will help you in this situation.
    – Skyhawk
    Nov 2, 2011 at 23:20
  • I guess my question is how do I ensure their only method of pushing code to the server is SVN? As far as I'm aware, you have to login to the server, then initiate a checkout. Or map the folder as a share and initiate the checkout. How do I have SVN run a checkout on-demand without having the user have access to the folder or server?
    – Driftpeasant
    Nov 2, 2011 at 23:25
  • Subversion is a service that runs on the server. They do not need access to the folder, nor access to log into the server. All they need to be able to check code in/out is access to Subversion itself. They use the command line (or possibly some kind of GUI shell) on their local machine to initiate a check-out.
    – Skyhawk
    Nov 2, 2011 at 23:26
  • I must be incredibly dense. So - you have a SVN Repo server. You have a IIS server. And you have the user. Ideally the user is supposed to check his/her code in from the workstation to the Repo. Then check the code out from the Repo to the IIS server folder. Then test. How does SVN running as a service accomplish the checkout bit? I get that I could script a Scheduled Task to run a batch file checkout, but I need it to be on demand, not at intervals.
    – Driftpeasant
    Nov 2, 2011 at 23:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .