Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a Subversion repository of private files, served by Apache over HTTPS using dav_svn. I'd like to give users in a single domain read access to a single file from this repository using HTTP. How do I write such an override? The current configuration:

<Location /svn>
  DAV svn
  SVNParentPath /var/lib/svn

  AuthzSVNAccessFile /etc/apache2/dav_svn.authz
  AuthType Basic
  AuthName "Subversion Repository"
  AuthUserFile /etc/apache2/dav_svn.passwd
  Require valid-user
</Location>
share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

This appears an old one, but it popped up in the RSS feed, so..

If I've understood the question correctly, you want to override the authentication for one file only.

<Location /svn>
  DAV svn
  SVNParentPath /var/lib/svn

  AuthzSVNAccessFile /etc/apache2/dav_svn.authz
  AuthType Basic
  AuthName "Subversion Repository"
  AuthUserFile /etc/apache2/dav_svn.passwd
  Require valid-user
</Location>

<Files /path/to/file>
  DAV svn
  SVNParentPath /var/lib/svn

  AuthzSVNAccessFile /etc/apache2/dav_svn.authz
  AuthType Basic
  AuthName "Subversion Repository"
  AuthUserFile /etc/apache2/dav_svn.passwd

  Require valid-user
  Allow from .some.domain.com # A domain name (requires the slow hostname lookups)
  Allow from 192.168.10.0/24 # An IP subnet
  Satisfy any    
</Files>

As katriel said, using the Satisfy directive allows you to specify alternate permission. Using this in the Files directive restricts the overrides to specific files. This won't allow commits as only one file has access without authentication. You can always make sure with a pre-commit or start-commit hook.

share|improve this answer
add comment

I don't think it is a good idea to expose a repository to anonymous commits under any circumstance. You might want to try a more elaborate setup, using a post-commit hook to perform an update and exposing that directory through an alias with read-only access for a particular subnet or domain:

e.g. in /var/lib/svn/repos/hooks/post-commit :

#!/bin/sh
# Of course, the update directory should be checked out the first time
cd /var/www/repomirror
svn update

And in your httpd.conf

<Location /repomirror>
    Order Deny,Allow
    Deny from all
    Allow from apache.org 
</Location>

YMMV

share|improve this answer
add comment

You could try using both authentication and allow,deny based access control on the same directory. The using "Satisfy" you can "OR" them both. Using the authz file, you can allow read-only access on a certain path in the repository It will look something like:

<Location /svn>
  DAV svn
  SVNParentPath /var/lib/svn

  AuthzSVNAccessFile /etc/apache2/dav_svn.authz
  AuthType Basic
  AuthName "Subversion Repository"
  AuthUserFile /etc/apache2/dav_svn.passwd

  Require valid-user
  Order Allow,Deny
  Allow from .some.domain.com
  Satisfy any

 </Location>

and in the authz file use

[repo:/public/dir]
* = r
@writers = rw

This is not a perfect solution, bur there's no real other way to exclude a domain from authenticating

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.