5

I'm attempting to setup svnserve with SASL support on my Slackware 13.1 server and after some trial and error I'm able to get it to work with the configuration listed below:

svnserve.conf

[general]
anon-access = read
auth-access = write
realm = myrepo

[sasl]
use-sasl = true
min-encryption = 128
max-encryption = 256

/etc/sasl2/svn.conf

pwcheck_method: auxprop
auxprop_plugin: sasldb
sasldb_path: /etc/sasl2/my_sasldb
mech_list: DIGEST-MD5

sasldb users

$ sasldblistusers2 -f /etc/sasl2/my_sasldb
test@myrepo: cmusaslsecretOTP
test@myrepo: userPassword

You'll notice that the output of sasldblistusers2 shows my test user as having both an encrypted cmusaslsecretOTP password as well as a plain text userPassword passwd. i.e., if I were to run strings /etc/sasl2/my_sasldb I would see the test users' password in plaintext. These two password entries were created with the following subversion book recommended command:

saslpasswd2 -c -f /etc/sasl2/my_sasldb -u myrepo test

After reading man saslpasswd2 I see the following option:

-n Don't set the plaintext userPassword property for the user. Only mechanism-specific secrets will be set (e.g. OTP, SRP)

This is exactly what I want to do, suppress the plain text password and only use the mechanism-specific secret (OTP in my case). So I clear out /etc/sasl2/my_sasldb and rerun saslpasswd2 as:

saslpasswd2 -n -c -f /etc/sasl2/my_sasldb -u myrepo test

I then follow it up with a sasldblistusers2 and I see:

$ sasldblistusers2 -f /etc/sasl2/my_sasldb
test@myrepo: cmusaslsecretOTP

Perfect! I think, now I have only encrypted passwords.... only neither the Linux svn client nor the Windows TortoiseSVN client can connect to my repo anymore. They both present me with the user/pass challenge but that's as far as I get.


TLDR

So, what is the point of SVN supporting SASL if my sasldb must store its passwords in plaintext to work?

3
  • Anything interesting under /var/log/ files? Disabling plaintext SHOULD be a completely normal thing to do. Commented Jan 25, 2011 at 12:12
  • @Janne I had svnserve run with --daemon --foreground and I don't see any output in that screen. I'll tail /var/log/messages and/or /var/log/syslog to see if I get anything useful out of that.
    – SiegeX
    Commented Jan 25, 2011 at 12:21
  • @Janne The only output I see is in /var/log/debug when I connect from the Linux svn client. Without userPasswd I only see svn: DIGEST-MD5 client step 2, however with userPasswd I see both that and svn: DIGEST-MD5 client step 3
    – SiegeX
    Commented Jan 25, 2011 at 12:40

1 Answer 1

1

This is hardly an answer but I'd like to point out that there are some sources that say explicitely that DIGEST-MD5 does not (and will never) support hashed passwords because it needs the plaintext password to do the challenge/response, like:

Other sources say otherwise:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .