Everything's running off of self-secured https. Aside from setting up user authentication, what steps should I take to be sure we're secured?

  • 1
    Which platform are you running it on? Apache? SVNSRV? Unix? Linux? Windows? – Mark Henderson Mar 30 '10 at 20:42
  • @Farseeker, the mention of https seems to strongly imply that Apache is being used. – Zoredache Mar 30 '10 at 20:46
  • Better safe than sorry... I've wasted a lot of time answering a question based on an incorrect assumption to just have to delete it later. – Mark Henderson Mar 30 '10 at 21:10
  • 1
    We shouldn't have to assume anything. Besides, assumption is the mother of all stuff-ups. – John Gardeniers Mar 30 '10 at 21:56
  • Audit your OS patches, make sure you are running the latest security fixes
  • Shutdown unneeded services, perform an external nmap scan to make sure you aren't running anything you don't need
  • Secure your webserver! Here is one such article for apache https://web.archive.org/web/1/http://blogs.techrepublic%2ecom%2ecom/10things/?p=477
  • Use LDAP or another extenral authentication mechanism (over SSL)
  • Enforce password strength and rotation policies
  • (if appropriate) set-up path level access

Subversion as a daemon is rather trusting itself and hands most of the fine-grained user-permissions back into the realm of apache. Can you tell us more about your exact scenario, are you offering this subversion server to public use?

When you say "self-secured" https, you mean a self-signed certificate? If so look at how you are distributing either that certificate or the CA and ensure that that path is secure in itself.

  • All good tips that can be applied to any operating system – Mark Henderson Mar 30 '10 at 20:43
  • If this is for internal users and you are not already behind a corporate firewall (and maybe even if you are) consider running a local firewall. Presumably the only thing you need is 443 and possibly 22 for ssh. – Mark Porter Mar 30 '10 at 20:57

Self-signed is not security; an attacker can generate their own self signed credentials and MiTM to the real server. This leaves the user unsure of who they're really talking to, unless you preshare the public key.

One specific step to take on SVN+WebDAV: make sure the authorization and authentication files are not within the docroot tree. You don't want to hand out something like that for people to beat on, esp if you use md5 for htaccess or something equally broken.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.