Question on svn authentication

[ji...@tektronix.com]

Hi,
 
We have a apache + open LDAP setup (subversion 1.5.2) for authentication
and are on linux. The issue is that by default, the passwd is saved in
cleartext in the auth file under home dir. Turning off the option for
saving passwd seems to be too inconvenient (comparing to cvs) to most
developers since then they will be prompted for passwd for most of the
commands.
 
Do you guys consider this an issue? Is there any plan to at least
encrypt it? 
 
Thanks for any feedback. We are trying to make it work asap.
 
Jianbing
 
 

Re: Question on svn authentication

[Ryan Schmidt <su...@ryandesign.com>]

On Oct 10, 2008, at 11:28, Andy Levy wrote:

> On Thu, Oct 9, 2008 at 14:35, wrote:
>
>> We have a apache + open LDAP setup (subversion 1.5.2) for  
>> authentication
>> and are on linux. The issue is that by default, the passwd is  
>> saved in
>> cleartext in the auth file under home dir. Turning off the option  
>> for saving
>> passwd seems to be too inconvenient (comparing to cvs) to most  
>> developers
>> since then they will be prompted for passwd for most of the commands.
>>
>> Do you guys consider this an issue? Is there any plan to at least  
>> encrypt
>> it?
>
> IIRC, the position is that it's the job of the host OS & filesystem to
> keep your credentials safe - file permissions, etc. IOW, make
> ~/.subversion only readable by the owner.

Right, see the FAQ:

http://subversion.tigris.org/faq.html#plaintext-passwords

Solutions for Mac OS X and Windows are already in place, and it says  
a solution for Unix is in the works for Subversion 1.6.



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: Question on svn authentication

[Andy Levy <an...@gmail.com>]

On Thu, Oct 9, 2008 at 14:35,  <ji...@tektronix.com> wrote:
> Hi,
>
> We have a apache + open LDAP setup (subversion 1.5.2) for authentication
> and are on linux. The issue is that by default, the passwd is saved in
> cleartext in the auth file under home dir. Turning off the option for saving
> passwd seems to be too inconvenient (comparing to cvs) to most developers
> since then they will be prompted for passwd for most of the commands.
>
> Do you guys consider this an issue? Is there any plan to at least encrypt
> it?
>
> Thanks for any feedback. We are trying to make it work asap.

IIRC, the position is that it's the job of the host OS & filesystem to
keep your credentials safe - file permissions, etc. IOW, make
~/.subversion only readable by the owner.

On Windows, there's a built-in crypto API that is called by SVN to
encrypt that data, and as of (I think) 1.4 SVN on uses the user's
Keychain on OS X. I don't think there's a comparable feature that's
ubiquitously available on *NIX, so it's left to the host OS &
filesystem permissions to keep things safe.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: Question on svn authentication

[Alec Kloss <al...@oracle.com>]

On 2008-10-10 15:03, David Weintraub wrote:
[chop]
> script. Besides, the passwords are moved over the network as plain
> text over svn:// and http:// protocol.  (Use svn+ssh:// and https://
> if you need strong security).
[chop]

This isn't always true.  If you're using Negotiate auth over
http:// or one of several SASL modules (NTLM, GSSAPI, DIGEST-MD5)
for svn:// the passwords aren't sent in the clear.  The Negotiate
crypto is generally considered insufficient so Neon requires you do
use https://, but it's still a lot better than using HTTP Basic
auth.

IMHO, what you (Jianbing) and your users should be more worried
about than the password cache file is the fact regardless of
protocol, the svn server, when using a clear-text login mechanism,
can be used to collect everyone's password.
 
Of course, as has been discussed elsewhere, deploying a SSO
mechanism (other than PKI with client certificates, which is pretty
much universally supported) with Subversion isn't exactly for the
faint of heart.  Fortunately it is getting easier all the time.

-- 
Alec.Kloss@oracle.com			Oracle Middleware
PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x432B9956

Re: Question on svn authentication

[David Weintraub <qa...@gmail.com>]

The permission (Unix wise) on the "auth" directory where the passwords
are stored is drwx------, so no one else can read or write to that
directory (except root). Thus, although passwords are plaintext, they
aren't visible to the world.

I think encryption if it isn't done right only give you a false sense
of security. CVS's passwords are easily broken with a simple Perl
script. Besides, the passwords are moved over the network as plain
text over svn:// and http:// protocol.  (Use svn+ssh:// and https://
if you need strong security).

All encryption does is make it harder for a user to figure out what is
going on without really adding to the security.

--
David Weintraub
qazwart@gmail.com



On Thu, Oct 9, 2008 at 2:35 PM,  <ji...@tektronix.com> wrote:
> Hi,
>
> We have a apache + open LDAP setup (subversion 1.5.2) for authentication
> and are on linux. The issue is that by default, the passwd is saved in
> cleartext in the auth file under home dir. Turning off the option for saving
> passwd seems to be too inconvenient (comparing to cvs) to most developers
> since then they will be prompted for passwd for most of the commands.
>
> Do you guys consider this an issue? Is there any plan to at least encrypt
> it?
>
> Thanks for any feedback. We are trying to make it work asap.
>
> Jianbing
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org