You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Himanshu Raina <ra...@yahoo.com> on 2007/01/08 07:28:39 UTC
Group Based Access !!
HI,
I am accessing my repositories over the network using svn protocol.I have a repository under which i have lot of project directories.I want to limit the access to directories i.e i want to provide group specific access.
Example:-
I have a repository name scholars
Under scholars i have different projects namely engineers,managers,programmers
As of now i make use of passwd file which provides the access to complete repository.I want to create a group say "test_group" which will have say 5 users and all these users shuld be able to access only scholars/engineers same way another group which can access scholar/managers .....
Could someone provide help on this.With http schema it can be done using svnaccessfile but how about cmdline access.
thanks and regards
Himanshu Raina
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
Re: Group Based Access !!
Posted by Ramanathan Muthaiah <ru...@gmail.com>.
On 1/8/07, Matt Sickler <cr...@gmail.com> wrote:
> unix directory permissions dont work on files *inside* the repository
> because, well, they are in the repository
Oh yes, you are correct.
I did not understand the problem / requirement of the initial post.
/Ram
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Group Based Access !!
Posted by Matt Sickler <cr...@gmail.com>.
unix directory permissions dont work on files *inside* the repository
because, well, they are in the repository
On 1/8/07, Ramanathan Muthaiah <ru...@gmail.com> wrote:
>
> > I have a repository name scholars
> > Under scholars i have different projects namely
> > engineers,managers,programmers
> > As of now i make use of passwd file which provides the access to
> complete
> > repository.I want to create a group say "test_group" which will have say
> 5
> > users and all these users shuld be able to access only
> scholars/engineers
> > same way another group which can access scholar/managers .....
>
> I assume your operating env is U*x.
>
> For your requirements, I think, the dir access permissions can be set
> using system commands.
>
> /Ram
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
> For additional commands, e-mail: users-help@subversion.tigris.org
>
>
Re: Group Based Access !!
Posted by Ramanathan Muthaiah <ru...@gmail.com>.
> I have a repository name scholars
> Under scholars i have different projects namely
> engineers,managers,programmers
> As of now i make use of passwd file which provides the access to complete
> repository.I want to create a group say "test_group" which will have say 5
> users and all these users shuld be able to access only scholars/engineers
> same way another group which can access scholar/managers .....
I assume your operating env is U*x.
For your requirements, I think, the dir access permissions can be set
using system commands.
/Ram
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Group Based Access !!
Posted by Matt Sickler <cr...@gmail.com>.
you want to use either svnserve or apache. make sure the repo files them
selves are locked down, and use mod_authz_svn (in apache, and its
counterpart authz_svn i think for svnserve) to limit user and/or group
access at a directory level
On 1/8/07, Himanshu Raina <ra...@yahoo.com> wrote:
>
> HI,
>
> I am accessing my repositories over the network using svn protocol.I have
> a repository under which i have lot of project directories.I want to limit
> the access to directories i.e i want to provide group specific access.
>
> Example:-
>
> I have a repository name scholars
> Under scholars i have different projects namely e
> ngineers,managers,programmers
> As of now i make use of passwd file which provides the access to complete
> repository.I want to create a group say "test_group" which will have say 5
> users and all these users shuld be able to access only scholars/engineerssame way another group which can access
> scholar/managers .....
>
> Could someone provide help on this.With http schema it can be done using
> svnaccessfile but how about cmdline access.
>
> thanks and regards
> Himanshu Raina
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
>
Re: Group Based Access !!
Posted by John Szakmeister <jo...@szakmeister.net>.
----- Himanshu Raina <ra...@yahoo.com> wrote:
> HI,
>
> I am accessing my repositories over the network using svn protocol.I
> have a repository under which i have lot of project directories.I want
> to limit the access to directories i.e i want to provide group
> specific access.
>
> Example:-
>
> I have a repository name scholars
> Under scholars i have different projects namely e
> ngineers,managers,programmers
> As of now i make use of passwd file which provides the access to
> complete repository.I want to create a group say "test_group" which
> will have say 5 users and all these users shuld be able to access only
> scholars/engineers same way another group which can access
> scholar/managers .....
>
> Could someone provide help on this.With http schema it can be done
> using svnaccessfile but how about cmdline access.
That's a good question... looking at the code I don't see that local access would do what you want, and that makes perfect sense. The problem with local access is that you need access to the database backend in order to commit. At that point, you can no longer restrict people. I mean, we could, but it doesn't stop anyone from compiling their own version and gaining access to the restricted area, since authorization is being done by the client. On top of that, you risk someone being able to upgrade the repository without your permission, and of course, there's the accidental 'rm -rf'.
I'd use svnserve to serve the repository, and I'd do it as it's own user. The repository should be only readable and writable by that user (otherwise, your engineers can use the file:// protocol to read the restricted area). Then you just use svn:// to access everything. This allows you to chose when you want to upgrade the repository, it keeps prying eyes from seeing unauthorized data/information, and svn:// access is fast.
Hope that helps!
-John
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org