Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i just try to put an SSL authentification for a SVN server over https. I would like that the client certificate allow authorized person to check their repositories.

<VirtualHost 37.187.96.147:443>

  ServerName toto.com:443
  DocumentRoot /var/www/html/
  SSLEngine on
  SSLProtocol all
  SSLCipherSuite HIGH:MEDIUM
  SSLStrictSNIVHostCheck on
  SSLCertificateFile /etc/ssl/certificate-authority/certs/svn-webserver.crt
  SSLCertificateKeyFile /etc/ssl/certificate-authority/private/svn-webserver.key
  ErrorLog /var/log/httpd/svn-error_log
  CustomLog logs/svn-access "%t %u %{SVN-ACTION}e" env=SVN-ACTION
  SSLCACertificateFile /etc/ssl/certificate-authority/certs/ca.crt
  SSLVerifyDepth       5
  SSLVerifyClient require
  SSLVerifyDepth 1
  LogLevel debug
  <Location /svn/>
    DAV svn
    SSLOptions           +FakeBasicAuth +StrictRequire
    SSLRequireSSL
    AuthName             "Depot SVN namek"
    AuthType             Basic
    AuthBasicProvider    file
    AuthUserFile         /var/svn/.fakehttpsauth
    Require              valid-user
    SVNParentPath /var/svn/
    SVNListParentPath on
    AuthzSVNAccessFile /var/svn/authz
  </Location>
</VirtualHost>

but that's not really usefull cause a got this type of username for my svn

/C=xx/ST=xx/L=xx/CN=MyUser

How could I use the SSLUserName apache directive to make a fakeauth with just the SSL_CLIENT_S_DN_CN of the client certificate (MyUser)

i got the 2.2.15 version of apache so i cant use the AuthBasicFake directive :/

if someone could help me that could be great ;).

thanks all

share|improve this question
    
did you manage to trim down the SSLUSername to the value of CN? – krisdigitx Mar 10 '15 at 17:14

In the .fakehttpsauth you need to put entries like:

/C=US/ST=CA/O=Doe Inc/CN=John Doe/emailAddress=john@doe.com:xxj31ZMTZzkVA

Here is a script to create such entries from your certificates:

#!/bin/bash
# export the certificates in fake auth format
# see http://serverfault.com/questions/533639/apache-authentication-with-ssl-certificate-and-sslusername
# WF 2016-01-06
fakepass=`openssl passwd -crypt -salt xx password`
for c in *.crt 
do
  openssl x509 -in $c -text  | grep Subject: | gawk -v fakepass=$fakepass '
BEGIN { FS="," }
{ 
  gsub("Subject: ","",$0)
  for (i=1;i<=NF;i++) {
    f=trim($i)
    printf("/%s",f);
  }
  printf(":%s\n",fakepass);
}

# see https://gist.github.com/andrewrcollins/1592991
function ltrim(s) { sub(/^[ \t\r\n]+/, "", s); return s }
function rtrim(s) { sub(/[ \t\r\n]+$/, "", s); return s }
function trim(s)  { return rtrim(ltrim(s)); }
'
done
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.