A hint on how to resurrect this if the subversion server would fail :)
git-svn-id: svn+ssh://svn.ipng.nl/usr/share/subversion/repositories/ircnet.ipng.ch@2 c5d60b8d-fdcb-4146-b734-af4215e9eb71
This commit is contained in:
ircnet
198
README.svn
Normal file
198
README.svn
Normal file
@ -0,0 +1,198 @@
|
||||
*******************************************************************
|
||||
Setup Guide for Linux Subversion Server, using SSH client access
|
||||
(using the svn+ssh protocol with svnserve -t)
|
||||
|
||||
Gunther Strube (gbs@users.sourceforge.net, March 2004)
|
||||
*******************************************************************
|
||||
|
||||
------------------------------------------------------------------
|
||||
0 Introduction
|
||||
------------------------------------------------------------------
|
||||
This Guide will explain in easy steps how to setup your Linux server
|
||||
working for Subversion repository access through SSH client access.
|
||||
|
||||
The svn+ssh:// protocol enables you to use SSH client access is throught
|
||||
the password prompt or using public private keys validation.
|
||||
No Public/private key generation is necessary to use the simplified
|
||||
svn+ssh protocol, but it might be a good idea, so that you can avoid
|
||||
password prompts all the time when using the SVN client access.
|
||||
|
||||
This guide assumes that you know how to setup SSH with public/private
|
||||
keys on the server and on your client, and that you already have
|
||||
installed Subversion on your Linux box.
|
||||
|
||||
------------------------------------------------------------------
|
||||
1. Install OpenSSH and Subversion binaries (distribution dependend)
|
||||
------------------------------------------------------------------
|
||||
Install your binaries on the Linux server (rpm, tgz), following your
|
||||
distributions installation scheme. To get SSH access working you need
|
||||
to install the OpenSSH server package.
|
||||
|
||||
Also remember:
|
||||
|
||||
root user must NOT be allowed to use SSH access (usually default).
|
||||
Make sure that the SSH server is being started at boot (init-scripts)
|
||||
|
||||
------------------------------------------------------------------
|
||||
2. Access restrictions to Subversion repositories
|
||||
------------------------------------------------------------------
|
||||
Using SSH in par with Subversion will only enable access to the
|
||||
Subversion repositories to users created and active on the server.
|
||||
To further restrict security, only those users (and root) can "work"
|
||||
on those files (as created by svnadmin), if logged on to the system
|
||||
(using the secure shell).
|
||||
|
||||
To ensure a clean interface, a new group is created, called svnusers.
|
||||
Add users to this group that wants access to Subversion repositories.
|
||||
(Use your favorite GUI admin tool or the command line)
|
||||
|
||||
All Subversion users should not be able to su to root (again for
|
||||
sake of security, compromising remote login and hacking the root password)
|
||||
|
||||
------------------------------------------------------------------
|
||||
2.1 Default umask for Subversion users
|
||||
------------------------------------------------------------------
|
||||
When each Subversion user accesses the reposity database through SSH
|
||||
it is vital that the corresping user doesn't destroy the group write
|
||||
permission during the SSH session (using the tunnelled svnserve command)
|
||||
Therefore, all Subversion users need an addition to their .bashrc file:
|
||||
|
||||
umask 002 # allow user + group to write, no other.
|
||||
|
||||
Please remember this also when creating new users (that needs Subversion
|
||||
access) on the server.
|
||||
|
||||
------------------------------------------------------------------
|
||||
2.2 Create a svnadm user account
|
||||
------------------------------------------------------------------
|
||||
Create this user with your favorite GUI tool or adduser command, and
|
||||
add it to the svnusers group.
|
||||
|
||||
This user is only for keeping a proper abstraction when working
|
||||
on the server. The svnadm user will of course be part of the
|
||||
svnusers group. This user should be used to create new Subversion
|
||||
projects, execute backup scripts, and work on general maintainance.
|
||||
|
||||
As with all Subversion users, the additional entry to the .bashrc file:
|
||||
|
||||
umask 002 # allow user + group to write, no other.
|
||||
|
||||
------------------------------------------------------------------
|
||||
3. Create a root path for the Subversion repositories
|
||||
------------------------------------------------------------------
|
||||
Create a path in where we will next create our Subversion
|
||||
repositories (as root):
|
||||
|
||||
mkdir -p /usr/share/subversion/repositories
|
||||
|
||||
Next, we will restrict access to this area only for root and svn users:
|
||||
|
||||
chown -R root.svnusers /usr/share/subversion/repositories
|
||||
chmod -R u+wrx,g+wrx,o-wxr /usr/share/subversion/repositories
|
||||
|
||||
Make sure that you have read and execute permission for root and svnusers
|
||||
users in the above directory path (check all nodes of the path).
|
||||
|
||||
------------------------------------------------------------------
|
||||
4. Creating a wrapper script for svnserve command
|
||||
------------------------------------------------------------------
|
||||
Using the svn+ssh protocol unfortunately discloses the absolute
|
||||
path of any Subversion project repository stored on the server's file
|
||||
system. This is quite unfortunate due to security reasons. The purpose of
|
||||
this wrapper script is to hide the root directory on your server where you
|
||||
store all your Subversion repositories.
|
||||
|
||||
First of all, rename the original svnserve command into svnserve.bin
|
||||
(it usually resides in /usr/bin/svnserve)
|
||||
|
||||
Paste the following text into your favorite Linux editor and change
|
||||
the /path/to/repository/root to something useful, eg.:
|
||||
/usr/share/subversion/repositories
|
||||
|
||||
Save the file as "svnserve", being the root superuser.
|
||||
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
#!/bin/sh
|
||||
# wrap in order to put root in by default
|
||||
# Script implemented by Adrian Robert <arobert@cogsci.ucsd.edu>
|
||||
|
||||
exec /usr/local/bin/svnserve.bin -r /path/to/repository/root "$@"
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
The -r option ensures that all URL specified paths (only the
|
||||
projects) will be appended to this root path. In other words this
|
||||
setup ensures that you only get access to repository projects inside
|
||||
the root path.
|
||||
|
||||
The wrapper script must be executable (and readable) by all.
|
||||
Only root can write: chmod u+wrx,g+rx-w,o+xr-w svnserve
|
||||
|
||||
------------------------------------------------------------------
|
||||
5. Creating a Subversion project repository
|
||||
------------------------------------------------------------------
|
||||
Finally, we're ready to actually create a Subversion repository that
|
||||
can be accessed through the svn+ssh protocol. Use svnadm to do the
|
||||
job:
|
||||
su - svnadm (log into svnadm user)
|
||||
|
||||
then use the svnadmin command to create a Subversion project:
|
||||
|
||||
svnadmin create /usr/share/subversion/repositories/project1
|
||||
("project1" just being an example, choose your own name)
|
||||
|
||||
finally, we need to remove the "other user" access of the new folder
|
||||
and contents (so that only svnusers have access):
|
||||
|
||||
chmod -R o-rwx /usr/share/subversion/repositories/project1
|
||||
|
||||
------------------------------------------------------------------
|
||||
5.1 Configuration of the Subversion project
|
||||
------------------------------------------------------------------
|
||||
Before we can open up for the world, we need to configure a few
|
||||
access settings in the project repository; nobody gets access to the
|
||||
repository, unless they are SSH authenticated (no anonymous access),
|
||||
and that the repository is enabled for write access for SSH
|
||||
authenticated users.
|
||||
|
||||
cd /usr/share/subversion/repositories/project1/conf
|
||||
|
||||
load the svnserve.conf into your favorite editor and add the following:
|
||||
|
||||
[general]
|
||||
anon-access = none
|
||||
auth-access = write
|
||||
|
||||
------------------------------------------------------------------
|
||||
6. Testing SSH client access (on localhost)
|
||||
------------------------------------------------------------------
|
||||
Log in to one of the svn users and try:
|
||||
|
||||
svn list svn+ssh://<user-id>@localhost/project1
|
||||
|
||||
you should be prompted for a password (and if that's successful),
|
||||
you just return back to the command line (because the newly created
|
||||
project is empty). This test ensures that the SSH server is running
|
||||
and that the svnserve tunneling is working.
|
||||
|
||||
------------------------------------------------------------------
|
||||
7. Congratulations!
|
||||
------------------------------------------------------------------
|
||||
You're now ready to play with Subversion on your remote clients, doing
|
||||
all the fun stuff with sub-versioning! Read the Subversion manual
|
||||
thoroughly and understand the concepts before going into hard core
|
||||
commit-mania!
|
||||
|
||||
One advice; use SSH Public/private keys with a user-agent to cache your
|
||||
ssh passphrase otherwise you will get nuts typing your password over
|
||||
and over again when issuing all those ssh command sessions.
|
||||
|
||||
There's a quick soultion if you're a TortoiseSVN user on Windows:
|
||||
|
||||
Open Explorer file window, right-click in the file section (get a pop-up),
|
||||
choose: TortoiseSVN -> Settings -> "Network" Pane-> SSH Client.
|
||||
|
||||
...\TortoisePlink.exe -l SSH_login_user_id -pw SSH_password
|
||||
|
||||
(if you specify a user ID here, then remember to remove the user ID
|
||||
from the svn+ssh URL)
|
||||
|
||||
Reference in New Issue
Block a user