Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a collection of subversion repositories on our server and want to get a VPN up and running so we can access them off site.

However, my boss insists that a select few repositories are not accessable unless you are actually in the office (or in the wireless outside...).

How can I achieve this?

My guess is to do something with the apache setup (we are using webdav)

share|improve this question

2 Answers 2

up vote 4 down vote accepted

You should look at the Order, Deny and Allow options. You should Allow from your local networks and deny from all. You'd use these config in a <Location> block for your repository url.

<Location /svn>
    SVNParentPath /var/svn
    DAV svn
    Order allow,deny
    Allow from all
</Location>

<Location /svn/secret>
    Order allow,deny
    Allow from 10.0.0.0/24
    Deny to all
</Location>
share|improve this answer
    
Looks like its more of an apache question than subversion –  Tim Jul 22 '09 at 16:30
1  
Yeah, subversion is particularly dumb. It doesn't really have any concept of access control. That's done in apache (or svnserve) –  David Pashley Jul 22 '09 at 16:33
    
Or particularly smart in that it leaves access and control to tools that are better suited to handling security and leaves itself to doing what it does well –  MikeJ Jul 22 '09 at 16:37
    
I meant the tool was dumb, not the design :) –  David Pashley Jul 22 '09 at 16:53

In your Apache config just set the server. instead of setting it to *:80 make it something like 192.168.0.5:80 for only in office and for the vpn only use 10.0.0.5:80

This is how we have it:

<VirtualHost *:80>
        ServerName 10.0.0.100
        ServerAlias svn.domain.com
        <Location "/">
                DAV svn
                SVNParentPath "/etc/subversion/repos"
                Require valid-user
                AuthType basic
                AuthName "Subversion Repository"
                AuthUserFile "/etc/subversion/repos/.user.passwd"
        </Location>
</VirtualHost>
share|improve this answer
    
so I just create two svnroots? one for public and one for only office? –  Tim Jul 22 '09 at 16:27
    
This won't work if the VPN user gets an IP address assigned from the same subnet as is the case with many end user VPN solutions. –  Kevin Kuphal Jul 22 '09 at 16:28
    
I'm not sure this does what the asker wants. –  David Pashley Jul 22 '09 at 16:28
    
I can set the VPN to have an ip range I like, the router should route it. –  Tim Jul 22 '09 at 16:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.