I'd like to setup Subversion repository so that same username and password could be used to access repository as in ssh login. I managed to get login work so that correct username is required, but it accepts any password. How I can get it to require valid password also?

I'm running Ubuntu server 8.04.2 with "standard modules", Apache2, Subversion and libapache2-mod-authnz-external. In addition I found utility called pwauth to help with authentication.

Here are the relevant parts from configuration:


AddExternalAuth pwauth /usr/local/bin/pwauth
SetExternalAuthMethod pwauth pipe
AddExternalGroup unixgroup /usr/local/bin/unixgroup
SetExternalGroupMethod unixgroup environment


AuthType Basic
AuthBasicProvider external
AuthExternal pwauth
GroupExternal unixgroup
AuthName "Subversion repository"
Require group users
Require user myaccount


auth    required        pam_succeed_if.so user=www-data
account required        pam_localuser.so

config.h for pwauth:

#define PAM                     /* Linux PAM or OpenPAM*/
#define UNIX_LASTLOG            /**/
#define HAVE_LASTLOG_H          /**/
#define NOLOGIN_FILE "/etc/nologin"     /**/
#define MIN_NOLOGIN_UID 1               /**/
#define CHECK_LOGIN_EXPIRATION          /**/
#define SERVER_UIDS 33          /* user "www-data" */
#define MIN_UNIX_UID 500        /**/
#define SLEEP_LOCK "/var/run/pwauth.lock"

(is something missing?)

Edit: I'm aware about potential security issues, but I want know why this setup doesn't work.

3 Answers 3


I have set this up before, and the way subversion works it would prompt you for your passwords hundreds of times during a session.

(To do this, simply connect your subversion client to svn+ssh://username@servername/path/to/repo)

The answer is to use ssh keys.

Set up your private/public key pair, and upload your public key to your ~/.ssh/authorized_keys file, but prefix it with "command="/usr/bin/svnserve -t -r /path/to/repo"

And connect again using svn+ssh as mentioned above

  • 1
    TortoiseSVN remembers the authentication information. Not the safest solution, but ok for current use.
    – Harriv
    Jun 10, 2009 at 20:44
  • Yeah, but SSH keys give better security with less hassle, once set up. Jun 10, 2009 at 21:55
  • 1
    Bad idea to use svn+ssh for a multi-user setup, it will create you a lot of trouble with permissions (for instance, files created by one user won't be modifiable by the others, depending on the umask). See "The svn+ssh:// Server Checklist" in svnbook.red-bean.com/en/1.5/svn.serverconfig.multimethod.html
    – bortzmeyer
    Jun 11, 2009 at 13:13
  • Good point - I remember we had to do a bit of permissions tweaking when we first set this up.
    – Brent
    Jun 11, 2009 at 15:00
  • When using command="/usr/bin/svnserve -t -r /path/to/repo" the user/key combination is bound to one repo, is there a secure way to allow the same user to access multiple repos?
    – Mene
    Apr 13, 2011 at 16:00

Don't do that. Do not use login passwords in potentially less secure applications. Use ssh keys like Brent says.


avoid apache altogether and use svn+ssh protocol


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.