We're rebuilding our Subversion server (currently HTTPS via Apache2) and considering just using svnserve instead of via Apache. We don't need any of the fancy features you get using Subversion via Apache.

The only thing I'm unsure about- we have some remote users who need to checkout code. Is the data sent to them via svnserve encrypted, or plain text over the wire? I don't want to use it if it's plain-text over the wire.

I also heard a rumor that if you use SASL with svnserve, you can force it to use encryption over the wire. Is that true?


Plain svn can be tunneled over SSH, which is pretty much what people consider to be "secure" today.

  • +1. sshd has fewer lines of code than apache httpd. Most people can get ssh with keys working, whereas fewer have ever tried getting client certificates to work - and, in some cases you benefit from regular OS access controls: repo hooks run as the individual user, not the www user. – Alex Holst Jan 28 '11 at 20:20

Although I am not familiar with svnserve, the answer to "is it plaintext" is to use a packet capture to see if it is encrypted. Even if svnserve is supposed to be encrypted, you won't know for sure that the encryption is active until you do a packet capture.

The standard tool for this is wireshark. tcpdump is another option if you like traditional *nix command line tools.

My recommendation would be to stick with the Apache/SVN option with SSL -- always easier to get help and find how-to documents on the popular solution.

  • The problem being that I believe svn compresses the content over the wire anyway... so it's not going to look like plain-text even if it's not encrypted. – Keith Palmer Jr. Feb 15 '11 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.