I am setting up Apache for Mercurial on Ubuntu 12.04.
sudo apt-get install libapache2-mod-wsgi sudo a2enmod auth_digest sudo /etc/init.d/apache2 restart sudo vim /etc/apache2/sites-available/default-ssl
and added this bit to the script
WSGIScriptAlias /hg /var/www/scripts/hgweb.wsgi <Directory /var/www/scripts> Order allow,deny Allow from all AuthType Digest AuthName "Company Mercurial repositories" AuthDigestProvider file AuthUserFile /home/ubuntu/hg/hgusers Require valid-user </Directory>
And pointing to the config file:
sudo vim /var/www/scripts/hgweb.wsgi
--> Replace config = "/path/to/repo/or/config" with config = "/home/ubuntu/hg/hgweb.config"
Then I created the password for the user like this:
sudo htdigest -c /home/ubuntu/hg/hgusers MyRealm username
Then I gave the script directory and repository directory access from browser:
sudo chown -R www-data:www-data /var/www/scripts sudo chown -R www-data:www-data /home/ubuntu/hg
Now when I go to https://mysite.com/hg I am asked for the username and password. I enter username and password (without realm) and it doesn't work.
Do I have to bring Realm also somehow into equation? How though?
Is this way of setting it up safe? Are you seeing any potential security leaks the way I setup mercurial?