Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've setup a script to do Subversion updates across two servers - the localhost and a remote server - called by a post-commit hook run by the www-data user.

/srv/svn/mysite/hooks/post-commit contains:

sudo -u cli /usr/local/bin/svn_deploy

/usr/local/bin/svn_deploy is owned by the cli user, and contains:

#!/bin/sh

svn update /srv/www/mysite
ssh cli@remotehost 'svn update /srv/www/mysite'

To get this to work I've had to add the following to the sudoers file:

www-data ALL = (cli) NOPASSWD: /usr/local/bin/svn_deploy
cli ALL = NOEXEC:NOPASSWD: /usr/local/bin/svn_deploy

Entries for both www-data and cli were necessary to avoid the error:

post commit hook failed: no tty present and no askpass program specified

I'm wary of giving any kind of elevated rights to www-data. Is there anything else I should be doing to reduce or eliminate any security risk?

share|improve this question

2 Answers 2

What you can do is to use something like svnsync.

From their site :

svnsync is the Subversion remote repository mirroring tool. Put simply, it allows you to replay the revisions of one repository into another one.

So, what you can do is to put an entry like this in the post-commit hooks section:

/usr/bin/svnsync synchronize svn://X.X.X.X/ --username XXXX --password 'XXXXXX' --non-interactive

This will sync the updates to the remote server and you also won't need to provide any special privilege to any user.

Hope this helped.

share|improve this answer
    
Sorry, I'm not following you. I'm not trying to mirror a repository. I'm updating working copies on multiple servers. –  jetboy Dec 5 '12 at 19:18
    
Oh yes. misunderstood the question. Sorry for that. Will see If I could think of any solution and then wil update you for the same. –  GeekRide Dec 5 '12 at 19:31
    
The mirrored repository can have its own post-commit hook. –  Ladadadada Dec 5 '12 at 23:16

I wouldn't use a unprivileged user (www-data) to perform administrative tasks. svn update seems more the job of root. So, I would not add this extra privilege for www-data. As you use a SSH connection, you could connect with a key authentication and create a force-command to restrict the action performed by root to 'svn update'. The public key to be saved on /root/.ssh/authorized_keys will look like:

command='svn update /srv/www/mysite',ssh-rsa dedllrfflr[...]

This way, your connection will be restricted to this particular command, and www-data does not get extra rights.

On client side, the command to launch the update is:

ssh -i /path/to/private/key root@server whatEverCommandYouMayImagine

Only the command contained in the forced-command will be launch if authentication succeeds

You then may deal with the Unix groups/rights of the uploaded files. For apache, it usually turns on:

find /srv/www/mysite -type f -print0 | xargs -0 chmod 640
find /srv/www/mysite -type d -print0 | xargs -0 chmod 750
find /srv/www/mysite -print0 | xargs -0 chown root:www-data
share|improve this answer
1  
Hi Philippe, I'm happy to consider alternatives, but the restriction here is that the post-commit trigger is run as www-data. Having this user svn update locally is pretty standard, but I need a method of letting www-data update the remote server. The cli user has been setup solely for admin tasks between servers in the cluster, so ssh uses public/private keys and is restricted to the local subnet. –  jetboy Dec 5 '12 at 16:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.