You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by James An <ja...@jamesan.ca> on 2009/02/23 17:29:02 UTC
FSFS repo on a network share
Hi,
I've created an FSFS repository and would like to put it in a remote network
location that is regularly backed-up.
I've read that it's poor practice to directly access repos over a network
and that I should set up svnserve or Apache. The SVN
book<http://svnbook.red-bean.com/en/1.2/svn.reposadmin.create.html>mentions
that network shares are bad for BDB repos, but doesn't really
comment on its use for FSFS ones. Some people say there are potential
problems for network repos that are accessible by multiple users.
If the FSFS repo (on a network share) is restricted so only a single user
can access it, are there any risks to directly accessing the repo with an
SVN client? If I extend the permissions so that multiple users can read-only
access the repo, but only one user can write to it, are there any additional
risks? If so, is there any way to mitigate those risks without a local SVN
server at that location?
Thanks,
James
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1215616
To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].
Re: FSFS repo on a network share
Posted by Stephen Connolly <st...@gmail.com>.
If the server hosting your files is linux, you might also want to look at my
blog post on linux+apache+subversion+sasl+active directory
google is your friend "Stephen's Java Adventures"
2009/2/26 David Weintraub <qa...@gmail.com>
> On Thu, Feb 26, 2009 at 1:26 PM, James An <ja...@jamesan.ca> wrote:
> > It works, but it's clumsy because:
> >
> > * there's a bunch of local Apache services running, when it should really
> be
> > centralized at the server where the repos are stored,
> > * user passwords are regularly changed and the researchers have to
> re-input
> > their passwords for the local Apache service to continue to log in as
> them
> > (to get the correct privileges to access the repo), and
> > * the local workstation where the service is run has to be on (and logged
> in?)
> > in order for the manager (the only other person accessing the repos) to
> > access the remote repo
> >
> > Am I circumventing the safety measures by having the SVN server retrieve
> the
> > repo over the network?
>
> The problem with file:// is that if you can access your Subversion
> repository via file://, you can go directly to the repository
> directory and muck around in it directly -- even delete it.
>
> You can use svnserve. It's simple to setup and you can have it store
> its own passwords for the researchers. Then, you don't need direct
> access to the repository via a network share. It takes a minute or two
> to setup, and except to make sure that svnserve is actually running,
> almost no maintenance. And, it is much more secure than just file://.
>
> If you use Apache's httpd, you can setup Apache to do logging in via
> the Windows LDAP server. Heck, it sounds like it's pretty much already
> setup. Then the two researchers will have access over http:// or
> https://. The security will be the same as what your Apache server
> currently does.
>
> --
> David Weintraub
> qazwart@gmail.com
>
> ------------------------------------------------------
>
> http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1234655
>
> To unsubscribe from this discussion, e-mail: [
> users-unsubscribe@subversion.tigris.org].
>
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1237594
To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].
Re: FSFS repo on a network share
Posted by David Weintraub <qa...@gmail.com>.
On Thu, Feb 26, 2009 at 1:26 PM, James An <ja...@jamesan.ca> wrote:
> It works, but it's clumsy because:
>
> * there's a bunch of local Apache services running, when it should really be
> centralized at the server where the repos are stored,
> * user passwords are regularly changed and the researchers have to re-input
> their passwords for the local Apache service to continue to log in as them
> (to get the correct privileges to access the repo), and
> * the local workstation where the service is run has to be on (and logged in?)
> in order for the manager (the only other person accessing the repos) to
> access the remote repo
>
> Am I circumventing the safety measures by having the SVN server retrieve the
> repo over the network?
The problem with file:// is that if you can access your Subversion
repository via file://, you can go directly to the repository
directory and muck around in it directly -- even delete it.
You can use svnserve. It's simple to setup and you can have it store
its own passwords for the researchers. Then, you don't need direct
access to the repository via a network share. It takes a minute or two
to setup, and except to make sure that svnserve is actually running,
almost no maintenance. And, it is much more secure than just file://.
If you use Apache's httpd, you can setup Apache to do logging in via
the Windows LDAP server. Heck, it sounds like it's pretty much already
setup. Then the two researchers will have access over http:// or
https://. The security will be the same as what your Apache server
currently does.
--
David Weintraub
qazwart@gmail.com
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1234655
To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].
Re: FSFS repo on a network share
Posted by Ted Stern <do...@gmail.com>.
Hi James,
I prefer the svn+ssh method through a single account method, as
described in The Fine Manual. Let's say the account is called
'svnuser' and the host I'll access on is 'svnhost'. Joe User's name
and email is first.m.last@mycompany.com
1) Each user sets up an access key. I have them do this:
umask 077
mkdir -p ~/.ssh
chmod 700 ~/.ssh
ssh-keygen -b 4096 -t rsa \
-C first.m.last@mycompany.com \
-f $HOME/.ssh/first.m.last_svnuser
<Carriage Return 2X for no-passphrase access>
2) The user sends me their public key via some secure channel
(encrypted attachment or maybe transports it physically via thumb
drive).
Alternatively, you can generate the key for them yourself and then
transmit it to them and have them install it in the proper place.
3) I install the public key in the ~svnuser/.ssh/authorized_keys file,
using something like this:
svnuser@svnhost% umask 077
svnuser@svnhost% mkdir .ssh ; cd .ssh
svnuser@svnhost% echo "command=\"$HOME/bin/svnserve_wrapper
first.m.last\",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty
| cat - first.m.last_svnuser.pub >> authorized_keys
4) Setup ~svnuser/bin/svnserve_wrapper:
,----
| #!/bin/bash
| # This is a wrapper for the svnserve command.
| #
| # Adjust parameters here
| SVNHOST="svnhost.mycompany.com"
| SVNPATH=/path/to/CollabNet_Subversion/bin
| SVNROOT=/path/to/repos
| #
| # Here's why we're running svnserve via a wrapper:
| # It allows us to
| # * Make changes in a single location instead of having to
| # edit ~svnuser/.ssh/authorized_keys
| # * Enforce access through a single host
| # * Set up corrrect umask
| # * Change PATH to find correct version of svnserve
| # * Set up path to svn repository
| # * Log subversion access
| #
| # Enforce single host:
| [[ "$(/bin/hostname)" = "$SVNHOST" ]] || {
| echo "Unauthorized host: svn+ssh access permitted only through $SVNHOST"
| exit 1
| }
|
| umask 077
| export PATH=$SVNPATH:$PATH
|
| # Do rudimentary logging
| # Format is YYYY-MM-DD-HH:MM:SS userid svn-args
| echo $(date -u '+%F-%X') "$@" "$SSH_CLIENT" >>/home/svnuser/logs/`date "+%Y-%m"`
|
| # extract the user id
| userid=$1
| shift
|
| # execute svnserve in correct format
| exec svnserve -t --tunnel-user=$userid -r $SVNROOT ${1+"$@"}
`----
Note that this means your svn log entries now show a human-readable
name instead of some complex account name! I like this, since our
company mandates user IDs that resemble secure passwords.
On the user side, they can create an ssh Host stanza to alias the
complicated access settings:
Host svnuser_svnroot
User svnuser
Hostname svnhost.mycompany.com
Protocol 2
IdentityFile ~/.ssh/first.m.last_svnuser
StrictHostKeyChecking no
For your needs, the nice thing about this is that once they are set
up, their svn access key doesn't change every time their account
password changes.
Another benefit of svn+ssh is that you don't have to involve the IT
admins to take care of Apache stuff. All you need is user-level
access.
Then they access the repository using this:
svn ls svn+ssh://svnuser_svnroot/project
Pretty compact, eh? And if you need to change the path to the
repository, it is transparent to the user. That's all handled by the
svnuser account.
Ted
--
Frango ut patefaciam -- I break so that I may reveal
On 26 Feb 2009 10:26:18 -0800, James An wrote:
>
> Thanks guys.
>
> I was thinking about just using file:// since it would greatly simplify
> everything, but worried about the consequences.
>
> Currently, the setup I've implemented is clumsy. Because of the
> confidentiality of work between researchers, they currently run a
> local Apache service (logged in as them through the network to get
> the right privileges to access the repo). The service authenticates
> against the Windows authentication (Active Directory?), which
> svnserve can't do (easily). So access to repos are by HTTP requests
> to the local workstation.
>
> It works, but it's clumsy because:
>
> * there's a bunch of local Apache services running, when it should really be
> centralized at the server where the repos are stored,
> * user passwords are regularly changed and the researchers have to re-input
> their passwords for the local Apache service to continue to log in as them
> (to get the correct privileges to access the repo), and
> * the local workstation where the service is run has to be on (and logged
> in?) in order for the manager (the only other person accessing the repos)
> to access the remote repo
>
> Am I circumventing the safety measures by having the SVN server retrieve the
> repo over the network?
>
> I don't have full access to the server that stores all these repos as I'm a
> researcher myself. The IT folks don't want to maintain a collection of research
> repos, so I'm looking for a work-around that is not as clumsy. -_-
>
> James
>
> On Tue, Feb 24, 2009 at 11:51 AM, <Ul...@elektrobit.com> wrote:
>
> Hi,
> ??
> to throw in my two cents:
> ??
> why not use svnadmin hotcopy to copy it over???AFAIK, that's what it's
> meant for...
> ??
> Cheers,
> ??
> Ulli
>
> ----------------------------------------------------------------------
> From: Bolstridge, Andrew [mailto:andy.bolstridge@intergraph.com]
> Sent: Tuesday, February 24, 2009 12:25 PM
>
> To: users@subversion.tigris.org
> Subject: RE: FSFS repo on a network share
>
> The best option is to host your filesystem SVN repository on the local
> drive and regularly copy it to the network share. Then you have a ???
> online backup???, and an ???offline??? backup as the IT guys do their
> thing.
>
> ??
>
> I???d set up a nightly copy using rsync, or xcopy to copy the data
> across. Obviously you may need to consider your options carefully if
> the DB is very large as all those little files can introduce quite a
> lot of network latency. If you have a very large number, it might be
> better to zip them all up and copy the zip file (or use svnadmin dump
> and copy the dump file)
>
> ??
>
> ??
>
> ??
>
> From: James An [mailto:james@jamesan.ca]
> Sent: Monday, February 23, 2009 5:29 PM
> To: users@subversion.tigris.org
> Subject: FSFS repo on a network share
>
> ??
>
> Hi,
>
> I've created an FSFS repository and would like to put it in a remote
> network location that is regularly backed-up.
>
> I've read that it's poor practice to directly access repos over a
> network and that I should set up svnserve or Apache. The SVN book
> mentions that network shares are bad for BDB repos, but doesn't really
> comment on its use for FSFS ones. Some people say there are potential
> problems for network repos that are accessible by multiple users.
>
> If the FSFS repo (on a network share) is restricted so only a single
> user can access it, are there any risks to directly accessing the repo
> with an SVN client? If I extend the permissions so that multiple users
> can read-only access the repo, but only one user can write to it, are
> there any additional risks? If so, is there any way to mitigate those
> risks without a local SVN server at that location?
>
> Thanks,
> James
>
> ----------------------------------------------------------------
> Please note: This e-mail may contain confidential information
> intended solely for the addressee. If you have received this
> e-mail in error, please do not disclose it to anyone, notify
> the sender promptly, and delete the message from your system.
> Thank you.
>
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1234643
To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].
Re: FSFS repo on a network share
Posted by James An <ja...@jamesan.ca>.
Thanks guys.
I was thinking about just using file:// since it would greatly simplify
everything, but worried about the consequences.
Currently, the setup I've implemented is clumsy. Because of the
confidentiality of work between researchers, they currently run a local
Apache service (logged in as them through the network to get the right
privileges to access the repo). The service authenticates against the
Windows authentication (Active Directory?), which svnserve can't do
(easily). So access to repos are by HTTP requests to the local workstation.
It works, but it's clumsy because:
- there's a bunch of local Apache services running, when it should really
be centralized at the server where the repos are stored,
- user passwords are regularly changed and the researchers have to
re-input their passwords for the local Apache service to continue to log in
as them (to get the correct privileges to access the repo), and
- the local workstation where the service is run has to be on (and logged
in?) in order for the manager (the only other person accessing the repos) to
access the remote repo
Am I circumventing the safety measures by having the SVN server retrieve the
repo over the network?
I don't have full access to the server that stores all these repos as I'm a
researcher myself. The IT folks don't want to maintain a collection of
research repos, so I'm looking for a work-around that is not as clumsy. -_-
James
On Tue, Feb 24, 2009 at 11:51 AM, <Ul...@elektrobit.com> wrote:
> Hi,
>
> to throw in my two cents:
>
> why not use svnadmin hotcopy to copy it over? AFAIK, that's what it's meant
> for...
>
> Cheers,
>
> Ulli
>
> ------------------------------
> *From:* Bolstridge, Andrew [mailto:andy.bolstridge@intergraph.com]
> *Sent:* Tuesday, February 24, 2009 12:25 PM
> *To:* users@subversion.tigris.org
> *Subject:* RE: FSFS repo on a network share
>
> The best option is to host your filesystem SVN repository on the local
> drive and regularly copy it to the network share. Then you have a ‘online
> backup’, and an ‘offline’ backup as the IT guys do their thing.
>
>
>
> I’d set up a nightly copy using rsync, or xcopy to copy the data across.
> Obviously you may need to consider your options carefully if the DB is very
> large as all those little files can introduce quite a lot of network
> latency. If you have a very large number, it might be better to zip them all
> up and copy the zip file (or use svnadmin dump and copy the dump file)
>
>
>
>
>
>
>
> *From:* James An [mailto:james@jamesan.ca]
> *Sent:* Monday, February 23, 2009 5:29 PM
> *To:* users@subversion.tigris.org
> *Subject:* FSFS repo on a network share
>
>
>
> Hi,
>
> I've created an FSFS repository and would like to put it in a remote
> network location that is regularly backed-up.
>
> I've read that it's poor practice to directly access repos over a network
> and that I should set up svnserve or Apache. The SVN book<http://svnbook.red-bean.com/en/1.2/svn.reposadmin.create.html>mentions that network shares are bad for BDB repos, but doesn't really
> comment on its use for FSFS ones. Some people say there are potential
> problems for network repos that are accessible by multiple users.
>
> If the FSFS repo (on a network share) is restricted so only a single user
> can access it, are there any risks to directly accessing the repo with an
> SVN client? If I extend the permissions so that multiple users can read-only
> access the repo, but only one user can write to it, are there any additional
> risks? If so, is there any way to mitigate those risks without a local SVN
> server at that location?
>
> Thanks,
> James
>
> ----------------------------------------------------------------
> Please note: This e-mail may contain confidential information
> intended solely for the addressee. If you have received this
> e-mail in error, please do not disclose it to anyone, notify
> the sender promptly, and delete the message from your system.
> Thank you.
>
>
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1234183
To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].
RE: FSFS repo on a network share
Posted by Ul...@elektrobit.com.
Hi,
to throw in my two cents:
why not use svnadmin hotcopy to copy it over? AFAIK, that's what it's
meant for...
Cheers,
Ulli
________________________________
From: Bolstridge, Andrew [mailto:andy.bolstridge@intergraph.com]
Sent: Tuesday, February 24, 2009 12:25 PM
To: users@subversion.tigris.org
Subject: RE: FSFS repo on a network share
The best option is to host your filesystem SVN repository on the
local drive and regularly copy it to the network share. Then you have a
'online backup', and an 'offline' backup as the IT guys do their thing.
I'd set up a nightly copy using rsync, or xcopy to copy the data
across. Obviously you may need to consider your options carefully if the
DB is very large as all those little files can introduce quite a lot of
network latency. If you have a very large number, it might be better to
zip them all up and copy the zip file (or use svnadmin dump and copy the
dump file)
From: James An [mailto:james@jamesan.ca]
Sent: Monday, February 23, 2009 5:29 PM
To: users@subversion.tigris.org
Subject: FSFS repo on a network share
Hi,
I've created an FSFS repository and would like to put it in a
remote network location that is regularly backed-up.
I've read that it's poor practice to directly access repos over
a network and that I should set up svnserve or Apache. The SVN book
<http://svnbook.red-bean.com/en/1.2/svn.reposadmin.create.html>
mentions that network shares are bad for BDB repos, but doesn't really
comment on its use for FSFS ones. Some people say there are potential
problems for network repos that are accessible by multiple users.
If the FSFS repo (on a network share) is restricted so only a
single user can access it, are there any risks to directly accessing the
repo with an SVN client? If I extend the permissions so that multiple
users can read-only access the repo, but only one user can write to it,
are there any additional risks? If so, is there any way to mitigate
those risks without a local SVN server at that location?
Thanks,
James
----------------------------------------------------------------
Please note: This e-mail may contain confidential information
intended solely for the addressee. If you have received this
e-mail in error, please do not disclose it to anyone, notify
the sender promptly, and delete the message from your system.
Thank you.
RE: FSFS repo on a network share
Posted by "Bolstridge, Andrew" <an...@intergraph.com>.
The best option is to host your filesystem SVN repository on the local
drive and regularly copy it to the network share. Then you have a
'online backup', and an 'offline' backup as the IT guys do their thing.
I'd set up a nightly copy using rsync, or xcopy to copy the data across.
Obviously you may need to consider your options carefully if the DB is
very large as all those little files can introduce quite a lot of
network latency. If you have a very large number, it might be better to
zip them all up and copy the zip file (or use svnadmin dump and copy the
dump file)
From: James An [mailto:james@jamesan.ca]
Sent: Monday, February 23, 2009 5:29 PM
To: users@subversion.tigris.org
Subject: FSFS repo on a network share
Hi,
I've created an FSFS repository and would like to put it in a remote
network location that is regularly backed-up.
I've read that it's poor practice to directly access repos over a
network and that I should set up svnserve or Apache. The SVN book
<http://svnbook.red-bean.com/en/1.2/svn.reposadmin.create.html>
mentions that network shares are bad for BDB repos, but doesn't really
comment on its use for FSFS ones. Some people say there are potential
problems for network repos that are accessible by multiple users.
If the FSFS repo (on a network share) is restricted so only a single
user can access it, are there any risks to directly accessing the repo
with an SVN client? If I extend the permissions so that multiple users
can read-only access the repo, but only one user can write to it, are
there any additional risks? If so, is there any way to mitigate those
risks without a local SVN server at that location?
Thanks,
James
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1220280
To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].
Re: FSFS repo on a network share
Posted by James An <ja...@jamesan.ca>.
Thanks for your help. The systems here use Windows almost exclusively,
although I don't think that's guaranteed that the filesystems will be the
same in the future. Given the high value of the data we'll be storing in the
repos, less trouble is certainly better.
I had thought about keeping the repo at the local workstations and simply
syncing the backup regularly; that's looking increasingly like the best
compromise according to our work environment. Currently, the repos will be
relatively small, but - yes - we'll need to think more about how to
appropriate deal with a large repo. Dumping and compressing it will probably
suffice for a very long time.
Anyways, thanks very much for your time. It's definitely appreciated.
James
On Mon, Feb 23, 2009 at 12:29 PM, James An <ja...@jamesan.ca> wrote:
> Hi,
>
> I've created an FSFS repository and would like to put it in a remote
> network location that is regularly backed-up.
>
> I've read that it's poor practice to directly access repos over a network
> and that I should set up svnserve or Apache. The SVN book<http://svnbook.red-bean.com/en/1.2/svn.reposadmin.create.html>mentions that network shares are bad for BDB repos, but doesn't really
> comment on its use for FSFS ones. Some people say there are potential
> problems for network repos that are accessible by multiple users.
>
> If the FSFS repo (on a network share) is restricted so only a single user
> can access it, are there any risks to directly accessing the repo with an
> SVN client? If I extend the permissions so that multiple users can read-only
> access the repo, but only one user can write to it, are there any additional
> risks? If so, is there any way to mitigate those risks without a local SVN
> server at that location?
>
> Thanks,
> James
>
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1221811
To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].
Re: FSFS repo on a network share
Posted by David Weintraub <qa...@gmail.com>.
Network shares will slow down Subversion, but I've used FSFS over NFS
before. However, this was done because the actual drive is on a disk
server, but we still used svn:// or http:// to access the repository.
Is this on a network share, so you can simply use file://? That's not
a good idea. I never use file:// even when the repository sits in my
HOME directory and I am the only one using the repository. It's simple
enough to start up svnserver and avoid file:// entirely. Then, you
really don't need a network share. Plus, the permission setting of
svnserver is pretty straight forward. It's perfect for small
repositories -- even one used by only a single user.
On Mon, Feb 23, 2009 at 12:29 PM, James An <ja...@jamesan.ca> wrote:
> Hi,
>
> I've created an FSFS repository and would like to put it in a remote network
> location that is regularly backed-up.
>
> I've read that it's poor practice to directly access repos over a network
> and that I should set up svnserve or Apache. The SVN book mentions that
> network shares are bad for BDB repos, but doesn't really comment on its use
> for FSFS ones. Some people say there are potential problems for network
> repos that are accessible by multiple users.
>
> If the FSFS repo (on a network share) is restricted so only a single user
> can access it, are there any risks to directly accessing the repo with an
> SVN client? If I extend the permissions so that multiple users can read-only
> access the repo, but only one user can write to it, are there any additional
> risks? If so, is there any way to mitigate those risks without a local SVN
> server at that location?
>
> Thanks,
> James
>
--
--
David Weintraub
qazwart@gmail.com
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1222016
To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].
Re: FSFS repo on a network share
Posted by Greg Troxel <gd...@ir.bbn.com>.
Network filesystems almost never have the same semantics as local
filesystems, and my opinion, I'm sure pretty widely shared, is that
accessing any kind of repository, be it cvs or svn, over a network file
system (especially a windows one) is asking for trouble - don't do it.
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1217481
To unsubscribe from this discussion, e-mail: [users-unsubscribe@subversion.tigris.org].