You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by jehan procaccia <je...@it-sudparis.eu> on 2008/11/14 18:01:18 UTC

scan repository for viruses

hello,

I know that some users commit files containing viruses :-(
how can I check/scan a svn repository for viruses before the they are 
spread on all clients updating their local files ?

I know that real files /revisions are located in db/revs subdir (ei 
/svn/repos/Test-repo/db/revs), but then it's only index filenames ...
is their a way to scan a repository on the server ?

PS: I use subversion-1.4.2-2.el5 on Centos 5.2 , btw, do you recommend 
an anti-virus under linux ?

Thanks.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: scan repository for viruses

Posted by Mark Eichin <ei...@gmail.com>.
On Fri, Nov 14, 2008 at 2:32 PM, jehan procaccia
<je...@it-sudparis.eu> wrote:
> Well, I understand that it won't be an easy task .
> I like this one:
> "Can't you just svnlook cat -t each file?"
> if you have a complete command sample with a pipe to clamav , that would
> same me hours searching how to do it ;-) .

We don't actually do the scanning (we use clamd for something else
entirely), but the extraction piece is basically
  * start with the pre-commit example
  * $SVNLOOK changed -t "$TXN" "$REPOS"  | cut -c5-
    to get a list of changed files
  * TMPDIR=$(mktemp -d)
     to get a place to work
  * $SVNLOOK cat "$REPOS" -t "$TXN" "$JAMPATH" > Jamfile
    except using the paths from the svnlook above, and instead of >
Jamfile, use a name for a tempfile, and then run "clamdscan
tempfile"... if you did a "set -e" in the script earlier, it'll exit
the whole thing with failure immediately, and the user will get the
stderr output spit back at them...

>
> The alternative of checking-out a dedicated Working Copy for scanning it
> with a windows antivirus and then commit back on the server repository only
> clean files seems ok to me, but what should I do with eventual infected
> files ? hopefully the antivirus would remove the virus from the infected
> file, and then I force a commit on it ? but how ? I have to do a small
> change in it so that it get a newer revision ?
>
> Thanks .
>
> Andy Levy a écrit :
>>
>> On Fri, Nov 14, 2008 at 13:19, Bob Archer <Bo...@amsi.com> wrote:
>>
>>>
>>> Can't you create pre-commit scripts client side to do something like
>>> this?
>>>
>>
>> Depends on what "this" is.
>>
>> To scan the file contents before they go into the repository, you'd
>> have to maintain a WC on the server for the whole repository (or
>> perform a checkout or export) and apply the diff to that WC, then run
>> the virus scan & check the results.
>>
>>
>>>
>>> -----Original Message-----
>>> From: Andy Levy [mailto:andy.levy@gmail.com]
>>> Sent: Friday, November 14, 2008 1:14 PM
>>> To: jehan.procaccia@it-sudparis.eu
>>> Cc: users@subversion.tigris.org
>>> Subject: Re: scan repository for viruses
>>>
>>> On Fri, Nov 14, 2008 at 13:01, jehan procaccia
>>> <je...@it-sudparis.eu> wrote:
>>>
>>>>
>>>> hello,
>>>>
>>>> I know that some users commit files containing viruses :-(
>>>> how can I check/scan a svn repository for viruses before the they are
>>>>
>>>
>>> spread
>>>
>>>>
>>>> on all clients updating their local files ?
>>>>
>>>> I know that real files /revisions are located in db/revs subdir (ei
>>>> /svn/repos/Test-repo/db/revs), but then it's only index filenames ...
>>>> is their a way to scan a repository on the server ?
>>>>
>>>> PS: I use subversion-1.4.2-2.el5 on Centos 5.2 , btw, do you recommend
>>>>
>>>
>>> an
>>>
>>>>
>>>> anti-virus under linux ?
>>>>
>>>
>>> Even when whole versions of the files are stored, I believe they're
>>> stored compressed. You'll have to check out each revision of the
>>> repository and scan incrementally.
>>>
>>> But what will you do once you've found the files? Remove them with
>>> svnadmin dump/svndumpfilter/svnadmin load?
>>>
>>> Won't the antivirus on the desktops protect those desktops when they
>>> perform a checkout? How did these infected files even get into the
>>> repository in the first place? You may fix the problem "today" but
>>> unless measures are in place, you could find yourself back in this
>>> same position next week.
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
>>> For additional commands, e-mail: users-help@subversion.tigris.org
>>>
>>>
>>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
> For additional commands, e-mail: users-help@subversion.tigris.org
>
>



-- 
_Mark_ <ei...@thok.org> <ei...@gmail.com>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: scan repository for viruses

Posted by Andy Levy <an...@gmail.com>.
On Fri, Nov 14, 2008 at 14:32, jehan procaccia
<je...@it-sudparis.eu> wrote:
> Well, I understand that it won't be an easy task .
> I like this one:
> "Can't you just svnlook cat -t each file?"
> if you have a complete command sample with a pipe to clamav , that would
> same me hours searching how to do it ;-) .
>
> The alternative of checking-out a dedicated Working Copy for scanning it
> with a windows antivirus and then commit back on the server repository only
> clean files seems ok to me, but what should I do with eventual infected
> files ? hopefully the antivirus would remove the virus from the infected
> file, and then I force a commit on it ? but how ? I have to do a small
> change in it so that it get a newer revision ?

You can't do this because the original commit hasn't completed yet at
that point. Your "clean" commit will sit forever waiting for the
infected commit to complete (remember, you're in pre-commit here)

I would suggest that you reject the commit altogether, and tell the
commiter "it appears you have a virus, fix it."

> Andy Levy a écrit :
>>
>> On Fri, Nov 14, 2008 at 13:19, Bob Archer <Bo...@amsi.com> wrote:
>>
>>>
>>> Can't you create pre-commit scripts client side to do something like
>>> this?
>>>
>>
>> Depends on what "this" is.
>>
>> To scan the file contents before they go into the repository, you'd
>> have to maintain a WC on the server for the whole repository (or
>> perform a checkout or export) and apply the diff to that WC, then run
>> the virus scan & check the results.
>>
>>
>>>
>>> -----Original Message-----
>>> From: Andy Levy [mailto:andy.levy@gmail.com]
>>> Sent: Friday, November 14, 2008 1:14 PM
>>> To: jehan.procaccia@it-sudparis.eu
>>> Cc: users@subversion.tigris.org
>>> Subject: Re: scan repository for viruses
>>>
>>> On Fri, Nov 14, 2008 at 13:01, jehan procaccia
>>> <je...@it-sudparis.eu> wrote:
>>>
>>>>
>>>> hello,
>>>>
>>>> I know that some users commit files containing viruses :-(
>>>> how can I check/scan a svn repository for viruses before the they are
>>>>
>>>
>>> spread
>>>
>>>>
>>>> on all clients updating their local files ?
>>>>
>>>> I know that real files /revisions are located in db/revs subdir (ei
>>>> /svn/repos/Test-repo/db/revs), but then it's only index filenames ...
>>>> is their a way to scan a repository on the server ?
>>>>
>>>> PS: I use subversion-1.4.2-2.el5 on Centos 5.2 , btw, do you recommend
>>>>
>>>
>>> an
>>>
>>>>
>>>> anti-virus under linux ?
>>>>
>>>
>>> Even when whole versions of the files are stored, I believe they're
>>> stored compressed. You'll have to check out each revision of the
>>> repository and scan incrementally.
>>>
>>> But what will you do once you've found the files? Remove them with
>>> svnadmin dump/svndumpfilter/svnadmin load?
>>>
>>> Won't the antivirus on the desktops protect those desktops when they
>>> perform a checkout? How did these infected files even get into the
>>> repository in the first place? You may fix the problem "today" but
>>> unless measures are in place, you could find yourself back in this
>>> same position next week.
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
>>> For additional commands, e-mail: users-help@subversion.tigris.org
>>>
>>>
>>>
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: scan repository for viruses

Posted by jehan procaccia <je...@it-sudparis.eu>.
jehan procaccia a écrit :
> jehan procaccia wrote:
>> I like this one:
>> "Can't you just svnlook cat -t each file?"
>> if you have a complete command sample with a pipe to clamav , that 
>> would same me hours searching how to do it ;-) .
> Ok, it took me a certain time (mostly with svnlook rather than clamav 
> ...), but I finnaly get it ;-)
> "svnlook cat each files and pipe the output to clamav antivirus"
> exemple:
> [root@svnserver /data2/svn/repos/test4/db]
> $ svnlook cat /data2/svn/repos/test4 "New Document Microsoft Office 
> Word.docx" | clamscan -
>
> Now I'll try to figure out how to write a script that gets a list of 
> all files in the repository (possibly "svnlook tree") to feed "svnlook 
> cat" in the first place .
For your Information, I finnaly wrote a script to scan the whole 
repository for virus, if it can help someone else ...

1) Get the full path list of files of the repository affected by viruses
$ svnlook tree --full-paths /svn/repos/repoName > 
/tmp/repoName-file-list.txt

2) write a script that scan each files in the list above
$ cat /root/svn-clamscan.sh        
#!/bin/bash
while read x
do
echo "____NEXT_FILE_____"
echo $x
svnlook cat /svn/repos/repoName "$x" | clamscan -
done < /tmp/repoName-file-list.txt

3) start it
$ time sh /root/svn-clamscan.sh > /tmp/clamscan-result-repoName.txt

4) check it 
$ grep "Infected files" /tmp/clamscan-result-repoName.txt | more

the whole thing could be more automated by creating input varaibles 
(repoName for example) but I didn't had to do it has I needed to scan 
only 2 repos .

hope it helps .. at least me next time ;-) .
Bye .



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: scan repository for viruses

Posted by jehan procaccia <je...@it-sudparis.eu>.
jehan procaccia wrote:
> Well, I understand that it won't be an easy task .
> I like this one:
> "Can't you just svnlook cat -t each file?"
> if you have a complete command sample with a pipe to clamav , that 
> would same me hours searching how to do it ;-) .
Ok, it took me a certain time (mostly with svnlook rather than clamav 
...), but I finnaly get it ;-)
"svnlook cat each files and pipe the output to clamav antivirus"
exemple:
[root@svnserver /data2/svn/repos/test4/db]
$ svnlook cat /data2/svn/repos/test4 "New Document Microsoft Office 
Word.docx" | clamscan -

Now I'll try to figure out how to write a script that gets a list of all 
files in the repository (possibly "svnlook tree") to feed "svnlook cat" 
in the first place .

Thanks for the advice .
>
> The alternative of checking-out a dedicated Working Copy for scanning 
> it with a windows antivirus and then commit back on the server 
> repository only clean files seems ok to me, but what should I do with 
> eventual infected files ? hopefully the antivirus would remove the 
> virus from the infected file, and then I force a commit on it ? but 
> how ? I have to do a small change in it so that it get a newer revision ?
>
> Thanks .
>
> Andy Levy a écrit :
>> On Fri, Nov 14, 2008 at 13:19, Bob Archer <Bo...@amsi.com> wrote:
>>  
>>> Can't you create pre-commit scripts client side to do something like
>>> this?
>>>     
>>
>> Depends on what "this" is.
>>
>> To scan the file contents before they go into the repository, you'd
>> have to maintain a WC on the server for the whole repository (or
>> perform a checkout or export) and apply the diff to that WC, then run
>> the virus scan & check the results.
>>
>>  
>>> -----Original Message-----
>>> From: Andy Levy [mailto:andy.levy@gmail.com]
>>> Sent: Friday, November 14, 2008 1:14 PM
>>> To: jehan.procaccia@it-sudparis.eu
>>> Cc: users@subversion.tigris.org
>>> Subject: Re: scan repository for viruses
>>>
>>> On Fri, Nov 14, 2008 at 13:01, jehan procaccia
>>> <je...@it-sudparis.eu> wrote:
>>>    
>>>> hello,
>>>>
>>>> I know that some users commit files containing viruses :-(
>>>> how can I check/scan a svn repository for viruses before the they are
>>>>       
>>> spread
>>>    
>>>> on all clients updating their local files ?
>>>>
>>>> I know that real files /revisions are located in db/revs subdir (ei
>>>> /svn/repos/Test-repo/db/revs), but then it's only index filenames ...
>>>> is their a way to scan a repository on the server ?
>>>>
>>>> PS: I use subversion-1.4.2-2.el5 on Centos 5.2 , btw, do you recommend
>>>>       
>>> an
>>>    
>>>> anti-virus under linux ?
>>>>       
>>> Even when whole versions of the files are stored, I believe they're
>>> stored compressed. You'll have to check out each revision of the
>>> repository and scan incrementally.
>>>
>>> But what will you do once you've found the files? Remove them with
>>> svnadmin dump/svndumpfilter/svnadmin load?
>>>
>>> Won't the antivirus on the desktops protect those desktops when they
>>> perform a checkout? How did these infected files even get into the
>>> repository in the first place? You may fix the problem "today" but
>>> unless measures are in place, you could find yourself back in this
>>> same position next week.
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
>>> For additional commands, e-mail: users-help@subversion.tigris.org
>>>
>>>
>>>     
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
> For additional commands, e-mail: users-help@subversion.tigris.org
>


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: scan repository for viruses

Posted by jehan procaccia <je...@it-sudparis.eu>.
Well, I understand that it won't be an easy task .
I like this one:
"Can't you just svnlook cat -t each file?"
if you have a complete command sample with a pipe to clamav , that would 
same me hours searching how to do it ;-) .

The alternative of checking-out a dedicated Working Copy for scanning it 
with a windows antivirus and then commit back on the server repository 
only clean files seems ok to me, but what should I do with eventual 
infected files ? hopefully the antivirus would remove the virus from the 
infected file, and then I force a commit on it ? but how ? I have to do 
a small change in it so that it get a newer revision ?

Thanks .

Andy Levy a écrit :
> On Fri, Nov 14, 2008 at 13:19, Bob Archer <Bo...@amsi.com> wrote:
>   
>> Can't you create pre-commit scripts client side to do something like
>> this?
>>     
>
> Depends on what "this" is.
>
> To scan the file contents before they go into the repository, you'd
> have to maintain a WC on the server for the whole repository (or
> perform a checkout or export) and apply the diff to that WC, then run
> the virus scan & check the results.
>
>   
>> -----Original Message-----
>> From: Andy Levy [mailto:andy.levy@gmail.com]
>> Sent: Friday, November 14, 2008 1:14 PM
>> To: jehan.procaccia@it-sudparis.eu
>> Cc: users@subversion.tigris.org
>> Subject: Re: scan repository for viruses
>>
>> On Fri, Nov 14, 2008 at 13:01, jehan procaccia
>> <je...@it-sudparis.eu> wrote:
>>     
>>> hello,
>>>
>>> I know that some users commit files containing viruses :-(
>>> how can I check/scan a svn repository for viruses before the they are
>>>       
>> spread
>>     
>>> on all clients updating their local files ?
>>>
>>> I know that real files /revisions are located in db/revs subdir (ei
>>> /svn/repos/Test-repo/db/revs), but then it's only index filenames ...
>>> is their a way to scan a repository on the server ?
>>>
>>> PS: I use subversion-1.4.2-2.el5 on Centos 5.2 , btw, do you recommend
>>>       
>> an
>>     
>>> anti-virus under linux ?
>>>       
>> Even when whole versions of the files are stored, I believe they're
>> stored compressed. You'll have to check out each revision of the
>> repository and scan incrementally.
>>
>> But what will you do once you've found the files? Remove them with
>> svnadmin dump/svndumpfilter/svnadmin load?
>>
>> Won't the antivirus on the desktops protect those desktops when they
>> perform a checkout? How did these infected files even get into the
>> repository in the first place? You may fix the problem "today" but
>> unless measures are in place, you could find yourself back in this
>> same position next week.
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
>> For additional commands, e-mail: users-help@subversion.tigris.org
>>
>>
>>     


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: Re: scan repository for viruses

Posted by Andy Levy <an...@gmail.com>.
On Fri, Nov 14, 2008 at 14:12, Mark Eichin <ei...@gmail.com> wrote:
> I'm happy with clamav, for scanning under linux.
>
> Can't you just svnlook cat -t each file? (We do that for a pre-commit
> jamfile linter, so we don't need a WC...)

Possibly. And just pipe the output to your AV software?

> On Nov 14, 2008 1:24 PM, "Andy Levy" <an...@gmail.com> wrote:
>
> On Fri, Nov 14, 2008 at 13:19, Bob Archer <Bo...@amsi.com> wrote: >
> Can't you create pre-commit...
>
> Depends on what "this" is.
>
> To scan the file contents before they go into the repository, you'd
> have to maintain a WC on the server for the whole repository (or
> perform a checkout or export) and apply the diff to that WC, then run
> the virus scan & check the results.
>
>> -----Original Message----- > From: Andy Levy [mailto:andy.levy@gmail.com]
>> > Sent: Friday, Novembe...

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: Re: scan repository for viruses

Posted by Mark Eichin <ei...@gmail.com>.

I'm happy with clamav, for scanning under linux.

Can't you just svnlook cat -t each file? (We do that for a pre-commit 
jamfile linter, so we don't need a WC...)

On Nov 14, 2008 1:24 PM, "Andy Levy" <an...@gmail.com> wrote:

On Fri, Nov 14, 2008 at 13:19, Bob Archer <Bo...@amsi.com> wrote: > 
Can't you create pre-commit...
Depends on what "this" is.

To scan the file contents before they go into the repository, you'd
have to maintain a WC on the server for the whole repository (or
perform a checkout or export) and apply the diff to that WC, then run
the virus scan & check the results.

> -----Original Message----- > From: Andy Levy [mailto:andy.levy@gmail.com] 
> Sent: Friday, Novembe...

Re: Re: scan repository for viruses

Posted by Andy Levy <an...@gmail.com>.
On Fri, Nov 14, 2008 at 13:19, Bob Archer <Bo...@amsi.com> wrote:
> Can't you create pre-commit scripts client side to do something like
> this?

Depends on what "this" is.

To scan the file contents before they go into the repository, you'd
have to maintain a WC on the server for the whole repository (or
perform a checkout or export) and apply the diff to that WC, then run
the virus scan & check the results.

> -----Original Message-----
> From: Andy Levy [mailto:andy.levy@gmail.com]
> Sent: Friday, November 14, 2008 1:14 PM
> To: jehan.procaccia@it-sudparis.eu
> Cc: users@subversion.tigris.org
> Subject: Re: scan repository for viruses
>
> On Fri, Nov 14, 2008 at 13:01, jehan procaccia
> <je...@it-sudparis.eu> wrote:
>> hello,
>>
>> I know that some users commit files containing viruses :-(
>> how can I check/scan a svn repository for viruses before the they are
> spread
>> on all clients updating their local files ?
>>
>> I know that real files /revisions are located in db/revs subdir (ei
>> /svn/repos/Test-repo/db/revs), but then it's only index filenames ...
>> is their a way to scan a repository on the server ?
>>
>> PS: I use subversion-1.4.2-2.el5 on Centos 5.2 , btw, do you recommend
> an
>> anti-virus under linux ?
>
> Even when whole versions of the files are stored, I believe they're
> stored compressed. You'll have to check out each revision of the
> repository and scan incrementally.
>
> But what will you do once you've found the files? Remove them with
> svnadmin dump/svndumpfilter/svnadmin load?
>
> Won't the antivirus on the desktops protect those desktops when they
> perform a checkout? How did these infected files even get into the
> repository in the first place? You may fix the problem "today" but
> unless measures are in place, you could find yourself back in this
> same position next week.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
> For additional commands, e-mail: users-help@subversion.tigris.org
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

RE: Re: scan repository for viruses

Posted by Bob Archer <Bo...@amsi.com>.
Can't you create pre-commit scripts client side to do something like
this?

-----Original Message-----
From: Andy Levy [mailto:andy.levy@gmail.com] 
Sent: Friday, November 14, 2008 1:14 PM
To: jehan.procaccia@it-sudparis.eu
Cc: users@subversion.tigris.org
Subject: Re: scan repository for viruses

On Fri, Nov 14, 2008 at 13:01, jehan procaccia
<je...@it-sudparis.eu> wrote:
> hello,
>
> I know that some users commit files containing viruses :-(
> how can I check/scan a svn repository for viruses before the they are
spread
> on all clients updating their local files ?
>
> I know that real files /revisions are located in db/revs subdir (ei
> /svn/repos/Test-repo/db/revs), but then it's only index filenames ...
> is their a way to scan a repository on the server ?
>
> PS: I use subversion-1.4.2-2.el5 on Centos 5.2 , btw, do you recommend
an
> anti-virus under linux ?

Even when whole versions of the files are stored, I believe they're
stored compressed. You'll have to check out each revision of the
repository and scan incrementally.

But what will you do once you've found the files? Remove them with
svnadmin dump/svndumpfilter/svnadmin load?

Won't the antivirus on the desktops protect those desktops when they
perform a checkout? How did these infected files even get into the
repository in the first place? You may fix the problem "today" but
unless measures are in place, you could find yourself back in this
same position next week.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: scan repository for viruses

Posted by Stefan Sperling <st...@elego.de>.
On Fri, Nov 14, 2008 at 01:14:17PM -0500, Andy Levy wrote:
> On Fri, Nov 14, 2008 at 13:01, jehan procaccia
> <je...@it-sudparis.eu> wrote:
> > hello,
> >
> > I know that some users commit files containing viruses :-(
> > how can I check/scan a svn repository for viruses before the they are spread
> > on all clients updating their local files ?
> >
> > I know that real files /revisions are located in db/revs subdir (ei
> > /svn/repos/Test-repo/db/revs), but then it's only index filenames ...
> > is their a way to scan a repository on the server ?
> >
> > PS: I use subversion-1.4.2-2.el5 on Centos 5.2 , btw, do you recommend an
> > anti-virus under linux ?
> 
> Even when whole versions of the files are stored, I believe they're
> stored compressed. You'll have to check out each revision of the
> repository and scan incrementally.
> 
> But what will you do once you've found the files? Remove them with
> svnadmin dump/svndumpfilter/svnadmin load?

I guess being alerted of that fact that something nasty has entered
the repository is what is desired. Implementing an automated fix
should be pretty much impossible. Scheduling a task in a post-commit
hook which causes the server to scan a working copy of the whole repo
for viruses and sends email when something is found is probably as
good as you can get wrt automation.

> How did these infected files even get into the
> repository in the first place? You may fix the problem "today" but
> unless measures are in place, you could find yourself back in this
> same position next week.

Yes. The real solution to the problem is educating users (which
is sometimes easier said than done...)

Stefan

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: scan repository for viruses

Posted by Andy Levy <an...@gmail.com>.
On Fri, Nov 14, 2008 at 13:01, jehan procaccia
<je...@it-sudparis.eu> wrote:
> hello,
>
> I know that some users commit files containing viruses :-(
> how can I check/scan a svn repository for viruses before the they are spread
> on all clients updating their local files ?
>
> I know that real files /revisions are located in db/revs subdir (ei
> /svn/repos/Test-repo/db/revs), but then it's only index filenames ...
> is their a way to scan a repository on the server ?
>
> PS: I use subversion-1.4.2-2.el5 on Centos 5.2 , btw, do you recommend an
> anti-virus under linux ?

Even when whole versions of the files are stored, I believe they're
stored compressed. You'll have to check out each revision of the
repository and scan incrementally.

But what will you do once you've found the files? Remove them with
svnadmin dump/svndumpfilter/svnadmin load?

Won't the antivirus on the desktops protect those desktops when they
perform a checkout? How did these infected files even get into the
repository in the first place? You may fix the problem "today" but
unless measures are in place, you could find yourself back in this
same position next week.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org