up vote 12 down vote favorite
share [g+] share [fb]

Currently I am using VisualSVN and it's only accessible on my home network. Eventually there will be others accessing it, but for now it's just me and I would like to be able to go down to the coffee shop (or wherever) and be able to work away from the house.

After doing a few web searches on the matter I decided it might be wise of me to ask for advice here so I don't waste too much time. Currently I'm accessing the server as "http://user-pc:xx/svn/Projects/". When I setup my router to forward port xx to my server, what steps should I take to protect myself?

Keep in mind that I am doing this on Windows and while I use the regular command prompt extensively, I haven't been on SVN very long and haven't used anything other than TortoiseSVN to work with it up to this point.

Edit: I see two votes to close this question already in just a few minutes. Clearly there must be something wrong with my question, but I haven't gotten any feedback as to what. I believe that Stack Overflow encourages you to give that feedback just as much as it encourages you to close poor questions. Please be helpful.

Edit 2: The only harmful thing an attacker could do, that I'm aware of, is to guess my port number, username, and password to get into the repository. However as the saying goes, I don't know what I don't know. So I'm not necessarily asking for step by step instructions (although I would certainly like to have that too) as much as what things I need to keep in consideration for any kind of attack that could be made once the port is open.

link|improve this question
40% accept rate
Can you define, what is "to protect myself?" for you? Protect your code, your Apache, your Windows from script-kiddies? – Lazy Badger Nov 20 '11 at 3:17
@LazyBadger See my edit – Brandon Moore Nov 20 '11 at 3:37
To answer the question you left in the flag, the SO close-voters didn't think this question deserved any more attention. They felt it was clearly off topic (like it is here, it's about a home server which is off topic) and didn't want to spend the time to explain again why, forgetting that for each occurrence it is someone's first time. I'm not a regular on SO so can't explain what their on/off topic thinking was. – sysadmin1138♦ Nov 20 '11 at 21:31
@sysadmin1138 Thanks for actually taking the time to write. I don't know what you mean by spending time to explain 'again' though since they never explained anything to begin with. I agree it seems off topic here, however it was not off topic at Stack Overflow and I would still love an explanation about that. I suspect there's not one though, and that they just arbitrarily decided they didn't like the question. – Brandon Moore Nov 20 '11 at 21:44
I left a flag on the SO question to see if I can get this shifted to a better home. – sysadmin1138♦ Nov 20 '11 at 21:45
feedback

migrated from stackoverflow.com Nov 20 '11 at 17:19

This question came from our site for professional and enthusiast programmers.

closed as off topic by sysadmin1138♦ Nov 20 '11 at 21:31

Questions on Server Fault are expected to generally relate to servers, networking, or desktop infrastructure, within the scope defined in the faq.

3 Answers

up vote 4 down vote accepted
  1. Use good password strength to secure the VisualSVN server
  2. Use a higher port for the server e.g. 39517 instead of the default port 80 or 443. Makes it harder for an attacker to guess. The attacker would have to rely on a port scan.
  3. VisualSVN server will not allow anonymous access. You need to explicitly define users.
  4. Give user access only to people you know/trust.
link|improve this answer
Shouldn't it be 4. Give user access only to people you trust ( don't let them use your account ) – orn Nov 20 '11 at 1:48
Given his #3, that's what I kind of assumed he meant. – Brandon Moore Nov 20 '11 at 1:50
@orn, that is what I mean. Sorry for my English. – desaivv Nov 20 '11 at 2:10
One thing I wondered about was brute force attempts to hack a password, but I forget they would have to guess the username as well so that's good. – Brandon Moore Nov 20 '11 at 2:12
@BrandonMoore they would also need to know the port. – desaivv Nov 20 '11 at 2:15
show 3 more comments
feedback
up vote 6 down vote
  1. Use https on server side, not plain http (AuthType Basic is interceptable) of use Digest auth (have to configure Apache by hand)
  2. Use (free) CA-issued cert on server, not self-signed (you can use self-signed cert, but will have (?) to verify it by eye every time)
  3. Maintain up-to-date VisualSVN Server version (with fixes for possible problems in Apache and|or SVN itself)
  4. Enable logging in httpd.conf for security-audit (no logging by default in VisualSVN Server)
link|improve this answer
feedback
up vote 1 down vote

I would recommend using ssh access to your svn server. I personally prefer public/private key authentication.

Even with that, desaivv's suggestions are also things that I would recommend.

link|improve this answer
Thanks Robert. In my google searches that's what I've found everyone says... but I haven't yet found any simple instructions on doing it with VisualSVN. Eventually I will learn about this stuff but in the meantime if you think you know of a laymen's guide to setting up ssh that might be simpler than the ones I've come across I would love to see it. – Brandon Moore Nov 20 '11 at 3:57
For client configuration: visualsvn.com/support/topic/00008 – robertvoliva Nov 20 '11 at 4:00
It looks like this book: my.safaribooksonline.com/book/-/9781849513449/… has an entire chapter around VisualSVN and ssh (Chapter 10). – robertvoliva Nov 20 '11 at 4:05
robert: Actually I did see that page. But it looks like that's just providing one piece of the puzzle. I don't know how to make public/private keys, if I need to do anything with Apache server or Windows, or my firewall, etc. to setup ssh. – Brandon Moore Nov 20 '11 at 4:09
Ah, I didn't see your 2nd comment before posting the one above. That book looks like it might be just what I need. – Brandon Moore Nov 20 '11 at 4:11
show 6 more comments
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.