You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Sahadeo Raskonda <sn...@gmail.com> on 2007/07/12 13:56:44 UTC
Query on SVN+SSH
Dear Folks,
Can anyone please help me on this ??
I have installed SVN-1.4 on RHEL4 Box by RPM's
Further configured SVN+SSH access by
1) Creating System users on the Box.
2) Wrapper script to embed svnserve
Like all steps in http://svn.haxx.se/dev/archive-2004-03/0253.shtml
and it works fine....
But problem is users can logon onto Box and delete entire REPO !!!
Further I was exploring http://svn.collab.net/repos/svn/trunk/notes/ssh-tricks
But this doesnot work fine...
*Any ideas on How to configure svn+ssh which uses system users and no shell
access to these users ?? *
Thanks in Advance for your help,
Regards,
Saha
Re: Query on SVN+SSH
Posted by Thomas Harold <tg...@tgharold.com>.
Sahadeo Raskonda wrote:
> Further configured SVN+SSH access by
>
> 1) Creating System users on the Box.
>
> 2) Wrapper script to embed svnserve
>
> Like all steps in http://svn.haxx.se/dev/archive-2004-03/0253.shtml
> <http://svn.haxx.se/dev/archive-2004-03/0253.shtml>
>
> and it works fine....
>
> But problem is users can logon onto Box and delete entire REPO !!!
I've never bothered with a wrapper script on our SVN server. We're
running SVN inside a virtual server with the following restrictions:
1) The sshd daemon only allows use of public-keys to authenticate.
2) User accounts are created and assigned a very long randomized
password that they are never told.
3) User accounts get added to a group (i.e. "svn-reposname") for each
repository that they need to access. Each repository directory is owned
by that group with the following permissions:
# cd /var/svn
# svnadmin create reposname
# chmod -R 770 reposname
# chgrp -R svn-reposname reposname
# chmod -R g+s reposname/db
4) Users have SSH public keys that they use to authenticate to the SVN
server with (using PuTTY + Pageant). Those keys are locked down with:
command="/usr/bin/svnserve -t -r
/var/svn",no-agent-forwarding,no-pty,no-port-forwarding,no-X11-forwarding
5) We configure a session in PuTTY with the following steps:
a) New session
b) Host name: svn.example.com
c) Host port: 922
(we run SSH on a non-standard port to lessen the # of attacks)
d) Connection, Data, Auto-Login name: (fill in username)
e) Save session as "svn.example.com:922"
(we access SVN using "svn+ssh://svn.example.com:922/reposname")
6) Our Windows users run a batch file when they login that loads the SVN
SSH key into Pageant (prompting them for their password), after which
point everything is seamless.
...
AFAIK, all of the above means that our users cannot get a shell account
on our SVN server. We get a few thousand attack attempts per month on
port 22/tcp (which is why we're moving the SVN server to an alternate
port this month).
If you need to share the server with regular user accounts you could
create svn-specific user accounts, put the SSH public key in those
authorized_keys files and authenticate the users using those
svn-specific accounts.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Query on SVN+SSH
Posted by Sahadeo Raskonda <sn...@gmail.com>.
svn+ssh works for me if I have wrapper script like
1) I rename /usr/bin/svnserve to /usr/bin/svnserve.bin
2) Create a shell script */usr/bin/svnserve* which has "*exec
/usr/bin/svnserve.bin -r /home/svn/repo "$@"* "
Now If I disable above script and have normal */usr/bin/svnserve* and
create as "/home/alice/.ssh/authorized_keys" file for alice's login with
belew entry.
command="/usr/bin/svnserve -t -r /repository/root
--tunnel-user=alice",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty
TYPE1 KEY1 COMMENT1
I have proper file permissions for the authorized* file
It doesnot work somewhow as told in this link -->
http://svn.collab.net/repos/svn/trunk/notes/ssh-tricks
Thanks in ADvance,
REgards,
Saha
On 7/12/07, Jason Winnebeck <jp...@rit.edu> wrote:
>
> It appears to me that the link you have sent will work if your SSH server
> supports that (it should since you are using RHEL). I didn't know you could
> put these options in the authorized_keys file.
>
> Jason
>
> ________________________________________
> From: Sahadeo Raskonda [mailto:snraskonda@gmail.com]
> Sent: Thursday, July 12, 2007 10:53 AM
> To: Jason Winnebeck
> Subject: Re: Query on SVN+SSH
>
> Thanks a Million Jason...
> Further I was exploring
> http://svn.collab.net/repos/svn/trunk/notes/ssh-tricks
> But this doesnot work fine...any ideas on this ??#
> Thanks,
> Saha
>
>
>
> On 7/12/07, Jason Winnebeck <jp...@rit.edu> wrote:
> The disadvantage for SVN+SSH access is that the users need to have shell
> accounts. It might be possible to have some login shell jiggery to make it
> so they can't log in, but if you really want to have control you need to use
> a server. If you are concerned about security, HTTPS over Apache is your
> best bet, otherwise SVN protocol can work to prevent the need for shell
> accounts, but is not secure.
>
> Jason Winnebeck
>
> ________________________________________
> From: Sahadeo Raskonda [mailto:snraskonda@gmail.com]
> Sent: Thursday, July 12, 2007 9:57 AM
> To: users@subversion.tigris.org
> Subject: Query on SVN+SSH
>
>
>
> Dear Folks,
>
> Can anyone please help me on this ??
>
> I have installed SVN-1.4 on RHEL4 Box by RPM's
> Further configured SVN+SSH access by
> 1) Creating System users on the Box.
> 2) Wrapper script to embed svnserve
> Like all steps in http://svn.haxx.se/dev/archive-2004-03/0253.shtml
> and it works fine....
>
> But problem is users can logon onto Box and delete entire REPO !!!
>
> Further I was exploring
> http://svn.collab.net/repos/svn/trunk/notes/ssh-tricks
> But this doesnot work fine...
>
> Any ideas on How to configure svn+ssh which uses system users and no shell
> access to these users ??
>
> Thanks in Advance for your help,
> Regards,
> Saha
>
>
RE: RE: Query on SVN+SSH
Posted by "Tjernstrom, Staffan" <st...@mail.esignal.com>.
Me being a linux newbie, this is probably not going to work, but how about setting the default users shell to /bin/false or /sbin/nologin and then having the ssh'd users pick that up?
Rgds
Staffan Tj.
Staffan Tjernström | Sr. Software Engineer - Market Data Systems | www.esignal.com
eSignal, Interactive Data Corporation Desktop Solutions (NYSE: IDC)
3955 Point Eden Way | Hayward, CA 94545-3720 | 510.723.1723 | FAX: 510.266.6100
-----Original Message-----
From: Jason Winnebeck [mailto:jpwasp@rit.edu]
Sent: Thursday, 12 July, 2007 10:00
To: Sahadeo Raskonda
Cc: users@subversion.tigris.org
Subject: RE: Query on SVN+SSH
It appears to me that the link you have sent will work if your SSH server supports that (it should since you are using RHEL). I didn't know you could put these options in the authorized_keys file.
Jason
________________________________________
From: Sahadeo Raskonda [mailto:snraskonda@gmail.com]
Sent: Thursday, July 12, 2007 10:53 AM
To: Jason Winnebeck
Subject: Re: Query on SVN+SSH
Thanks a Million Jason...
Further I was exploring http://svn.collab.net/repos/svn/trunk/notes/ssh-tricks
But this doesnot work fine...any ideas on this ??#
Thanks,
Saha
On 7/12/07, Jason Winnebeck <jp...@rit.edu> wrote:
The disadvantage for SVN+SSH access is that the users need to have shell accounts. It might be possible to have some login shell jiggery to make it so they can't log in, but if you really want to have control you need to use a server. If you are concerned about security, HTTPS over Apache is your best bet, otherwise SVN protocol can work to prevent the need for shell accounts, but is not secure.
Jason Winnebeck
________________________________________
From: Sahadeo Raskonda [mailto:snraskonda@gmail.com]
Sent: Thursday, July 12, 2007 9:57 AM
To: users@subversion.tigris.org
Subject: Query on SVN+SSH
Dear Folks,
Can anyone please help me on this ??
I have installed SVN-1.4 on RHEL4 Box by RPM's
Further configured SVN+SSH access by
1) Creating System users on the Box.
2) Wrapper script to embed svnserve
Like all steps in http://svn.haxx.se/dev/archive-2004-03/0253.shtml
and it works fine....
But problem is users can logon onto Box and delete entire REPO !!!
Further I was exploring http://svn.collab.net/repos/svn/trunk/notes/ssh-tricks
But this doesnot work fine...
Any ideas on How to configure svn+ssh which uses system users and no shell access to these users ??
Thanks in Advance for your help,
Regards,
Saha
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
DISCLAIMER: This message (including any files transmitted with it) may contain confidential and / or proprietary information, is the property of Interactive Data Corporation and / or its subsidiaries and is directed only to the addressee(s). If you are not the designated recipient or have reason to believe you received this message in error, please delete this message from your system and notify the sender immediately. An unintended recipient's disclosure, copying, distribution or use of this message, or any attachments, is prohibited and may be unlawful.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
RE: Query on SVN+SSH
Posted by Jason Winnebeck <jp...@rit.edu>.
It appears to me that the link you have sent will work if your SSH server supports that (it should since you are using RHEL). I didn't know you could put these options in the authorized_keys file.
Jason
________________________________________
From: Sahadeo Raskonda [mailto:snraskonda@gmail.com]
Sent: Thursday, July 12, 2007 10:53 AM
To: Jason Winnebeck
Subject: Re: Query on SVN+SSH
Thanks a Million Jason...
Further I was exploring http://svn.collab.net/repos/svn/trunk/notes/ssh-tricks
But this doesnot work fine...any ideas on this ??#
Thanks,
Saha
On 7/12/07, Jason Winnebeck <jp...@rit.edu> wrote:
The disadvantage for SVN+SSH access is that the users need to have shell accounts. It might be possible to have some login shell jiggery to make it so they can't log in, but if you really want to have control you need to use a server. If you are concerned about security, HTTPS over Apache is your best bet, otherwise SVN protocol can work to prevent the need for shell accounts, but is not secure.
Jason Winnebeck
________________________________________
From: Sahadeo Raskonda [mailto:snraskonda@gmail.com]
Sent: Thursday, July 12, 2007 9:57 AM
To: users@subversion.tigris.org
Subject: Query on SVN+SSH
Dear Folks,
Can anyone please help me on this ??
I have installed SVN-1.4 on RHEL4 Box by RPM's
Further configured SVN+SSH access by
1) Creating System users on the Box.
2) Wrapper script to embed svnserve
Like all steps in http://svn.haxx.se/dev/archive-2004-03/0253.shtml
and it works fine....
But problem is users can logon onto Box and delete entire REPO !!!
Further I was exploring http://svn.collab.net/repos/svn/trunk/notes/ssh-tricks
But this doesnot work fine...
Any ideas on How to configure svn+ssh which uses system users and no shell access to these users ??
Thanks in Advance for your help,
Regards,
Saha
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
RE: Query on SVN+SSH
Posted by Jason Winnebeck <jp...@rit.edu>.
The disadvantage for SVN+SSH access is that the users need to have shell accounts. It might be possible to have some login shell jiggery to make it so they can't log in, but if you really want to have control you need to use a server. If you are concerned about security, HTTPS over Apache is your best bet, otherwise SVN protocol can work to prevent the need for shell accounts, but is not secure.
Jason Winnebeck
________________________________________
From: Sahadeo Raskonda [mailto:snraskonda@gmail.com]
Sent: Thursday, July 12, 2007 9:57 AM
To: users@subversion.tigris.org
Subject: Query on SVN+SSH
Dear Folks,
Can anyone please help me on this ??
I have installed SVN-1.4 on RHEL4 Box by RPM's
Further configured SVN+SSH access by
1) Creating System users on the Box.
2) Wrapper script to embed svnserve
Like all steps in http://svn.haxx.se/dev/archive-2004-03/0253.shtml
and it works fine....
But problem is users can logon onto Box and delete entire REPO !!!
Further I was exploring http://svn.collab.net/repos/svn/trunk/notes/ssh-tricks
But this doesnot work fine...
Any ideas on How to configure svn+ssh which uses system users and no shell access to these users ??
Thanks in Advance for your help,
Regards,
Saha
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Query on SVN+SSH
Posted by Stephen Carville <ca...@heronforge.net>.
Sahadeo Raskonda wrote:
> Dear Folks,
>
>
>
> Can anyone please help me on this ??
>
>
>
> I have installed SVN-1.4 on RHEL4 Box by RPM's
>
> Further configured SVN+SSH access by
>
> 1) Creating System users on the Box.
>
> 2) Wrapper script to embed svnserve
>
> Like all steps in http://svn.haxx.se/dev/archive-2004-03/0253.shtml
>
> and it works fine....
>
>
>
> But problem is users can logon onto Box and delete entire REPO !!!
>
>
>
> Further I was exploring
> http://svn.collab.net/repos/svn/trunk/notes/ssh-tricks
>
>
> But this doesnot work fine...
>
>
>
> *Any ideas on How to configure svn+ssh which uses system users and no shell
> access to these users ?? *
>
Create a dedicated user for the repository -- call it "svn". Do not
give it a password. Access it using sudo or some similar tool.
Only allow ssh Version 2 access. This is important.
Add each user's public key to ~/.ssh/authorized_keys. Precede each key
with a command to run svnserve in tunnel mode (This entry has to all be
on one line.)
command="/usr/bin/svnserve --root=/var/svn/repos --tunnel \
--tunnel-user=<username>" ssh-rsa <public key> user@machine
The above will start svnserve in tunnel mode with a root directory of
/var/svn/repos and set the username for recording any file manipulations
to "<username>"
The URL for accessing the repository then becomes
svn+ssh://svn@<subversion sserver>/<repository>
Users may or may not have shell access but will only be able to log on
with their own accounts, not svn.
>
> Thanks in Advance for your help,
>
> Regards,
>
> Saha
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org