Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a collection of subversion repositories on our server and want to get a VPN up and running so we can access them off site.

However, my boss insists that a select few repositories are not accessable unless you are actually in the office (or in the wireless outside...).

How can I achieve this?

My guess is to do something with the apache setup (we are using webdav)

share|improve this question
up vote 4 down vote accepted

You should look at the Order, Deny and Allow options. You should Allow from your local networks and deny from all. You'd use these config in a <Location> block for your repository url.

<Location /svn>
    SVNParentPath /var/svn
    DAV svn
    Order allow,deny
    Allow from all

<Location /svn/secret>
    Order allow,deny
    Allow from
    Deny from all
share|improve this answer
Looks like its more of an apache question than subversion – Tim Jul 22 '09 at 16:30
Yeah, subversion is particularly dumb. It doesn't really have any concept of access control. That's done in apache (or svnserve) – David Pashley Jul 22 '09 at 16:33
Or particularly smart in that it leaves access and control to tools that are better suited to handling security and leaves itself to doing what it does well – MikeJ Jul 22 '09 at 16:37
I meant the tool was dumb, not the design :) – David Pashley Jul 22 '09 at 16:53

In your Apache config just set the server. instead of setting it to *:80 make it something like for only in office and for the vpn only use

This is how we have it:

<VirtualHost *:80>
        <Location "/">
                DAV svn
                SVNParentPath "/etc/subversion/repos"
                Require valid-user
                AuthType basic
                AuthName "Subversion Repository"
                AuthUserFile "/etc/subversion/repos/.user.passwd"
share|improve this answer
so I just create two svnroots? one for public and one for only office? – Tim Jul 22 '09 at 16:27
This won't work if the VPN user gets an IP address assigned from the same subnet as is the case with many end user VPN solutions. – Kevin Kuphal Jul 22 '09 at 16:28
I'm not sure this does what the asker wants. – David Pashley Jul 22 '09 at 16:28
I can set the VPN to have an ip range I like, the router should route it. – Tim Jul 22 '09 at 16:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.