Must setup users umask and possibly run svnserve with setgid set to have consistent filesystem rights.Multiple repositories, means you should have separate group for each and manage access rights by adding/removing users from groups.single group with group read-write access on repository files) All repository users must have access rights to repository (ie.You have to setup almost nothing, works out of the box (the tunnel, repository access rights needs a little work).So this points me to decision not to use Apache as server for SVN repositories (and also, I don’t want Apache on my system).
Of course, you can run second instance of Apache to prevent previously mentioned problems, but this is second instance of Apache you have to take care of, configure it, maintain it and another point of possibly security problems. iI you run single instance of Apache, it will have read-write permission to your subversion repositorories, so will all possibly buggy web apps running under Apache – thats huge security problem – one bug in your web CMS can give attacker full access to all your repositories – thats nothing I’m dreaming off. You have to use Apache and its modules – this means one more layer with possible security problems and bugs (proper use PKI certificates will prevent most of this problems, but not all of them). Apache ? What is it some dummy alternative to nginx or lighttpd ?. Access rights managed by subversion configuration (nf). Use PKI certificates to secure network communication channel. You can use Apache modules for user authentication (ie. I’m not mentioning use of svnserve listening on widely open Internet port, because this is so insecure that I’m not going to talk about it. So I have created my own way how to remotely access subversion repository in secure and easy way.įirst, I’ll try to describe existing ways to do this and what problems they have. 
There are (as far i know) two basic ways to do this and I was not satisfied with neither of them, due to some security and hard-to-setup-or-maintain problems. I was dealing with problem how to remotely access subversion server in secure way.
0 kommentar(er)
