You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Christoph Anton Mitterer <ca...@mathematica.scientia.net> on 2005/05/10 18:28:30 UTC
some questions about setting up svn with Apache httpd
Hi.
I've got some questions and I hope someone can help me.
I've just set up my Apache 2 Server (using the default Debian packages).
First of all I'd like to have all transmissions between client an server
be encrypted and verified. So I musst use SSL. (And it would be best if
I could in some way forbid normal http mode for the svn server).
My first question: Is the communication already secure (e.g. agains man
in the middle attack) if I securely transmitt my servers SSL certificate
to all clients or is it required that the clients authenticate
themselves with an SSL certificate too (in order to get secured and
verified communication)?
2nd Question how do I properly set up my apache that it uses https and
ONLY https for svn (including such questions like how do I create my
Apaches SSL certificate)? Or is there some guide where you could give me
the URL to?
As far as I've understood,... if my svn server uses SSL the
communication should be secured (but perhas not fully - see first
question) but now I have to set up authentication method:
I think there are now to possible methods:
1) "Normal" Password/User Authentication => How would my config files
look if I'd like to do that?
2) Or each Client has its own Certificate => Again: How do I setup my
config that this (and only this) method would work.
2a) How do I create the clients certificates? And how does the server
knows that a certificate (from a cliend) is allowed to acces the
repository? I suppose I must use the servers certificate to sign the
clients certificate? If so how does this work =) ?
3) Are there others?
The Autz_svn_mod is only used to set finer access rules (e.g. to
directories), isn't it?
And last but not least: Is it still possible to make single repositorys
worldwide readable (even when i use all the Client/server/SSL
Certificates stuff I told before)?
Lots of thanks and greetings,
Christoph Anton Mitterer.
Re: some questions about setting up svn with Apache httpd
Posted by Christoph Anton Mitterer <ca...@mathematica.scientia.net>.
Stephane Bortzmeyer wrote:
>>My first question: Is the communication already secure (e.g. agains
>>man in the middle attack) if I securely transmitt my servers SSL
>>certificate to all clients or is it required that the clients
>>authenticate themselves with an SSL certificate too (in order to get
>>secured and verified communication)?
>>
>>
>Define "secure". What do you fear? That the MIM poses as the server or
>as a client? SSL can protect both.
>
>
I need both. I need the same security that I'd get when encrypting and
signing emails e.g. with GnuPG.
I get encryption to hide my data from others, and verification (my
message is signed with my key, thus I can check if the data has been
modified by others).
>>2nd Question how do I properly set up my apache that it uses https and
>>ONLY https for svn
>>
>>
>
>Here is what I do, note the automatic redirection if someone does not
>use SSL and uses the port 80:
>
>
Good idea :-)
># Subversion
><VirtualHost 192.134.7.250:80>
>ServerName svn.generic-nic.net
>Redirect permanent / https://svn.generic-nic.net/
></VirtualHost>
>
><VirtualHost 192.134.7.250:443>
>ServerName svn.generic-nic.net
>SSLEnable
>...
>
>
In the meantime I found some other information including the following
directives:
|<VirtualHost *:443>
ServerName svn.trilithium.net
SSLEngine on
SSLCertificateFile /path/to/certificate
SSLCertificateKeyFile /path/to/keyfile
SSLCertificateChainFile /path/to/ca-certificate
<Location />
DAV svn
SSLRequireSSL
SVNPath /path/to/repository
SVNIndexXSLT /stylesheet/uri
AuthType Basic
AuthName "Subversion repository"
AuthUserFile /path/to/htpasswd
AuthGroupFile /path/to/htgroup
AuthzSVNAccessFile /path/to/accessfile
Satisfy any
Require valid-user
</Location>
</VirtualHost>|
First of all? Why is the <location> element within the <VirtualHost>?
And how do I properly all this SSL* directives? Should I place them
inside <Location>?
Afaik SSLRequireSSL means that a connection has to be SSL encoded. I
think I don't need the Satisfy directive but I don't completely
understand the first 4 SSL-directives.
>>1) "Normal" Password/User Authentication => How would my config files
>>look if I'd like to do that?
>>
>>
>
>Here is what I do, in the same <VirtualHost> (I use LDAP but the
>general idea is the same):
>
><Location />
> AuthType Basic
> AuthName "Subversion Repository"
> AuthLDAPURL ldap://ldap.eureg.org/ou=People,dc=eureg,dc=eu?uid?sub?(objectClass=*)
> require valid-user
></Location>
>
>
btw: Thanx for your help :)
Re: some questions about setting up svn with Apache httpd
Posted by Stephane Bortzmeyer <bo...@nic.fr>.
On Tue, May 10, 2005 at 08:28:30PM +0200,
Christoph Anton Mitterer <ca...@mathematica.scientia.net> wrote
a message of 63 lines which said:
> My first question: Is the communication already secure (e.g. agains
> man in the middle attack) if I securely transmitt my servers SSL
> certificate to all clients or is it required that the clients
> authenticate themselves with an SSL certificate too (in order to get
> secured and verified communication)?
Define "secure". What do you fear? That the MIM poses as the server or
as a client? SSL can protect both.
> 2nd Question how do I properly set up my apache that it uses https and
> ONLY https for svn
Here is what I do, note the automatic redirection if someone does not
use SSL and uses the port 80:
# Subversion
<VirtualHost 192.134.7.250:80>
ServerName svn.generic-nic.net
Redirect permanent / https://svn.generic-nic.net/
</VirtualHost>
<VirtualHost 192.134.7.250:443>
ServerName svn.generic-nic.net
SSLEnable
...
> 1) "Normal" Password/User Authentication => How would my config files
> look if I'd like to do that?
Here is what I do, in the same <VirtualHost> (I use LDAP but the
general idea is the same):
<Location />
AuthType Basic
AuthName "Subversion Repository"
AuthLDAPURL ldap://ldap.eureg.org/ou=People,dc=eureg,dc=eu?uid?sub?(objectClass=*)
require valid-user
</Location>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org