Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for a SVN setup that allows by repository permissions without using SSH. At the moment we have an SVN server with several repos and are accessing it through the SSH+SVN protocol. I created a UNIX group for each repository and add the users who needed access to that group. Essentially I am using the UNIX file permissions for access control. However we have encountered an issue when we moved to Windows 8 and the Cisco Any Connect Client for VPN access where we cannot open SSH tunnels, for whatever reason I don't know, networking and VPN is not my area of expertise. Anyway I have been asked to look into an alternative setup for our SVN server.

As far as I know the other protocols available are SVN, HTTP, and HTTPS. At one point we were using HTTP with basic_auth but anyone who had a password could read/write to all repos. We want to lock down access to a by repository basis. Is there anyway to do this with SVN using the SVN or HTTP protocol. We also want it hands off as much as possible for management purposes, meaning I don't want to have to maintain a vhost and password file for every repo. Any advice or suggestions are appreciated. We have moved to Git for new projects but still have several in SVN that developers don't want to move.

FYI, the server is Linux, CentOS 6.4 so preferable a Linux solution.

Okay So I tried setting up path based authentication but I'm running into some problems so I hope someone can help.

Here is my svn.conf file from /etc/httpd/conf.d/

LoadModule dav_svn_module       modules/mod_dav_svn.so
LoadModule authz_svn_module     modules/mod_authz_svn.so

<VirtualHost *:80>

        ServerName svn.test.net
        ServerAdmin admin.test.net
        ServerSignature Off

        <Location /svn>

                DAV svn
                SVNPath /home/svn/repos
                #SVNListParentPath on

                AuthType Basic
                AuthName "Test SVN Server"
                AuthUserFile /home/svn/svn-passwd

                AuthzSVNAccessFile /home/svn/svn-access

                Require valid-user

        </Location>

        ErrorLog /var/log/httpd/svn_error.log
        CustomLog /var/log/httpd/svn_access.log combined

</VirtualHost>

The authentication seems to be working fine however no mater what path I enter it always seems to try to read from /home/svn/repos/format

[Sun Jan 19 06:19:30 2014] [error] [client 192.168.17.117] (20014)Internal error: Can't open file '/home/svn/repos/format': No such file or directory
[Sun Jan 19 06:19:30 2014] [error] [client 192.168.17.117] Could not fetch resource information.  [500, #0]
[Sun Jan 19 06:19:30 2014] [error] [client 192.168.17.117] Could not open the requested SVN filesystem  [500, #2]
[Sun Jan 19 06:19:30 2014] [error] [client 192.168.17.117] Could not open the requested SVN filesystem  [500, #2]

If I enter http://svn.test.net.svn.repo1 or http://svn.test.net.svn.repo2 I get the same message in the error log.

All the repos are stored at /home/svn/repos. Apache has ownership of the entire /home/svn directory recursively with rwx permissions. Is there something I'm missing or configured wrong?

In my svn-access file I have something like this

[groups]
testgroup = testuser

[/]
* = r

[/repo1]
@testgroup1 = rw
share|improve this question
    
Holy blob of text, batman. Perhaps edit your question to add a few paragraph breaks. :) –  EEAA Jan 17 at 16:51
    
I cleaned it up a little :) –  greyfox Jan 17 at 16:53
add comment

1 Answer

up vote 1 down vote accepted

The most flexible way to do this would be to move back to Apache with mod_dav_svn and basic auth, and use AuthzSVNAccessFile to enforce access controls - this allows assigning users no permission, read, and read/write based on repo and logical path within the repo.

See here for more info.

share|improve this answer
    
Thanks, I'll look into this and if it works out for us I will mark this as the accepted answer. –  greyfox Jan 17 at 19:10
    
I ran into a snag trying to setup path based permissions. I updated my question. I'm hoping I just missed something –  greyfox Jan 19 at 16:10
    
@greyfox Looks like you'll want to swap SVNPath for SVNParentPath - SVNPath implies that there's only one repo at the exact location you're pointing to, while SVNParentPath is for a directory containing repos as you have. –  Shane Madden Jan 19 at 18:03
    
Yep that was it. Thanks!! –  greyfox Jan 19 at 18:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.