Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I create an user john on my server and I add him into the SVN group so we can share our code and everything looks okay. Now I want to prevent this user from connecting to the console or shell via SSH. In /etc/ssh/sshd_confing file I add this lines:

Match User john
  ForceCommand svnserve -t

I would like to ask if is my configuration safe enough? SVN commands over SSH works fine. When he tries to connect, he gets:

blueprint:~ john$ ssh john@91.***.***.96 -p **5
john@91.***.***.96's password:
( success ( 2 2 ( ) ( edit-pipeline svndiff1 absent-entries commit-revprops depth log-revprops partial-replay ) ) )

^CConnection to 91.***.***.96 closed.
blueprint:~ john$

I have two questions:

  • Is this it? Is there a way for a john to login on my server on a somehow hackable way?
  • Does exist an option on server to return him a nice message You do not have permission to login! ?
share|improve this question
add comment

1 Answer 1

up vote 3 down vote accepted

This is a correct way how to do it. I have just two points how you may additionally improve security of your SVN server.

Firstly, you can allow SSH public key authentication only. If so, you can then lock user's password with

passwd -l USERNAME

Secondly, you can create a simple wrapper script (spawned shell is replaced with svnserve command) and use it with ForceCommand option which includes warning message

cat > /usr/local/bin/svn_cmd_wrapper.sh <<EOF
#!/bin/sh -f

echo "You do not have permission to login!"
echo
exec svnserve -t
EOF

Then, make it executable

chmod u+x /usr/local/bin/svn_cmd_wrapper.sh

and use it in sshd_config file:

ForceCommand /usr/local/bin/svn_cmd_wrapper.sh
share|improve this answer
    
I will think about public key authentication. You forget quotation marks at the end of the first echo and I had to change permission and group (chown root:svn svn_cmd_wrapper.sh and chmod 754 svn_cmd_wrapper.sh) Anyway I like your idea. Is there a way to recognize svnserve -t command and allow it and notify the user about permissions for any other command? –  Marek Sep 15 '13 at 12:47
    
We just put the following at the start of the authorized_key line: command="/usr/bin/svnserve -t -r /var/svn",no-agent-forwarding,no-pty,no-port-forwarding,no-X11-forwarding –  tgharold Sep 28 '13 at 4:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.