You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Cecil Westerhof <Ce...@decebal.nl> on 2011/03/23 14:47:46 UTC
Setting the caching of passwords only localy
As I understand it the caching or not is done through setting:
${HOME}/.subversion/servers
Is it possible to do this centrally?
--
Cecil Westerhof
Senior Software Engineer
LinkedIn: http://www.linkedin.com/in/cecilwesterhof
Re: Setting the caching of passwords only localy
Posted by Nico Kadel-Garcia <nk...@gmail.com>.
On Wed, Mar 23, 2011 at 11:04 AM, Stefan Sperling <st...@elego.de> wrote:
> On Wed, Mar 23, 2011 at 02:47:46PM +0100, Cecil Westerhof wrote:
>> As I understand it the caching or not is done through setting:
>> ${HOME}/.subversion/servers
>>
>> Is it possible to do this centrally?
>
> Put this in /etc/subversion/servers:
>
> [global]
> store-plaintext-passwords=no
I'm looking for documentation on this. I don't see it *anywhere*,
except a few comments in the source code for
libsvn_subr/config_file.c, not in the manual pages nor in the
"redbook".
Moreover, this only works on a single client host basis, it won't work
if the subversion is installed locally with a distinct "./configure
--sysconfdir=/etc" setting, it can be overridden in the individual
user's $HOME/.subversionn/servers file, etc., etc.
It's not a reliable approach. If you want to be sure of clients not
storing passwords with Subversion, you pretty much can't use password
based access techniques.
Re: Setting the caching of passwords only localy
Posted by Stefan Sperling <st...@elego.de>.
On Wed, Mar 23, 2011 at 02:47:46PM +0100, Cecil Westerhof wrote:
> As I understand it the caching or not is done through setting:
> ${HOME}/.subversion/servers
>
> Is it possible to do this centrally?
Put this in /etc/subversion/servers:
[global]
store-plaintext-passwords=no
Re: Setting the caching of passwords only localy
Posted by Cecil Westerhof <Ce...@decebal.nl>.
Op woensdag 23 mrt 2011 15:02 CET schreef Nico Kadel-Garcia:
>> As I understand it the caching or not is done through setting:
>> ${HOME}/.subversion/servers
>>
>> Is it possible to do this centrally?
>
> Your question is a bit unclear. The client needs cached keys, or
> passwords, in order to do anything that requires network authorization
> on the upstream Subversion server. The Windows clients, such as
> TortoiseSVN, have their own encrypted key storage setup. The UNIX and
> Linux clients will store HTTP/HTTPS passwords in
> $HOME/.subversion/servers, by default, and store them in clear text.
That is where the configuration is. In my case it was saved in:
~/.subversion/auth/svn.simple/a350574f4c355826cf779d6c707aa69f
> It's possible to use access techniques that do not do this, such as
> SSL keys or SSH keys for svn+ssh. That requires the client to have a
> private, ideally passphrase protected, and the public keys to be
> stored and managed on the server. This is coverd in the Subversion
> "red book", though the actual management of the keys is not well
> addressed.
>
> Would that cover your needs?
Not really. I would like that it is `impossible' that passwords are
stored in clear text. Now every user can decide for itself. Because
the situation properly will be that the people will do a commit in the
evening and a update in the morning, it would not be a big problem
that they have to input there password every-time.
But maybe I am going to far. Seeing that now everything is done by
(unencrypted) FTP, it would be a big improvement when they would use
subversion with SASL. So lets first implement this. Later on I could
make things even more secure.
--
Cecil Westerhof
Senior Software Engineer
LinkedIn: http://www.linkedin.com/in/cecilwesterhof
Re: Setting the caching of passwords only localy
Posted by Nico Kadel-Garcia <nk...@gmail.com>.
On Wed, Mar 23, 2011 at 9:47 AM, Cecil Westerhof <Ce...@decebal.nl> wrote:
> As I understand it the caching or not is done through setting:
> ${HOME}/.subversion/servers
>
> Is it possible to do this centrally?
Your question is a bit unclear. The client needs cached keys, or
passwords, in order to do anything that requires network authorization
on the upstream Subversion server. The Windows clients, such as
TortoiseSVN, have their own encrypted key storage setup. The UNIX and
Linux clients will store HTTP/HTTPS passwords in
$HOME/.subversion/servers, by default, and store them in clear text.
It's possible to use access techniques that do not do this, such as
SSL keys or SSH keys for svn+ssh. That requires the client to have a
private, ideally passphrase protected, and the public keys to be
stored and managed on the server. This is coverd in the Subversion
"red book", though the actual management of the keys is not well
addressed.
Would that cover your needs?