You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Justin Johnson <ju...@fastmail.fm> on 2004/02/16 14:56:15 UTC
Managing users
I'm looking for the easiest way to manage (add/remove) subversion users.
I was hoping to find some way to hook into their NT login and password
via the domain controllor, but the current method (sspi, etc) seems
rather unsupported/unmaintained, so I don't feel comfortable going in
that direction.
The next best option to me seems to be using svnserve and accounts that
have SSH access. I assume this would be done via local or NIS users.
But the problem is I don't want to give users local access to login and
run commands on the server. Is there a way to create users that can be
used for svn only, but can't be used to login to the system and get a
shell? Something like setting their shell to /dev/null?
I'm going to do some testing on my own, but thought someone else may have
run into this already.
Thanks in advance.
-Justin
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Managing users
Posted by Eric Gillespie <ep...@pretzelnet.org>.
"Justin Johnson" <ju...@fastmail.fm> writes:
> run commands on the server. Is there a way to create users
> that can be used for svn only, but can't be used to login to
> the system and get a shell? Something like setting their shell
> to /dev/null?
You can limit the command a user authorized with a given key can
run. And you already have password authentication turned off,
right? You want something like this in the user's
authorized_keys files:
command="/usr/pkg/bin/svnserve -r /svn -t" ssh-rsa ...
See the sshd(8) man page for more info.
--
Eric Gillespie <*> epg@pretzelnet.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Managing users
Posted by Justin Johnson <ju...@fastmail.fm>.
Excellent! Thanks so much!
On Mon, 16 Feb 2004 15:03:33 -0500, "Dominic Anello" <da...@danky.com>
said:
> On 2004-02-16 09:32:52 -0600, Justin Johnson wrote:
> > I don't doubt that it may work well. The lack of support is more what
> > I'm concerned about. From my research it seemed the code wasn't
> > maintained by anyone anymore. Also, I'd prefer to run the server on a
> > UNIX box.
> >
> > Thanks for the info though.
> > -Justin
> > On Mon, 16 Feb 2004 16:09:33 +0100, "Carsten Schurig"
> > <cs...@ebz-dresden.de> said:
> > > Justin Johnson <ma...@fastmail.fm> wrote on Monday,
> > > February 16, 2004 3:56 PM:
> > >
> > >
> > > > I'm looking for the easiest way to manage (add/remove) subversion
> > > > users. I was hoping to find some way to hook into their NT login and
> > > > password via the domain controllor, but the current method (sspi,
> > > > etc) seems rather unsupported/unmaintained, so I don't feel
> > > > comfortable going in that direction.
> > >
> > > I'm using this option and it works well. For that I've installed apache
> > > on our Win2K server. I configured it to listen for https:// on a
> > > non-standard port and not to listen on any other ports. I don't know if
> > > you can setup apache on a Linux or any other unix machine and do a
> > > password lookup on a windows DC.
> > >
> > > Cheers,
> > > Carsten
>
> Funny, I just solved this problem this morning using LDAP.
>
> You have to be running an ActiveDirectory domain for this to work.
>
> Configure apr-util --with-ldap and apache with --enable-ldap and
> --enable-ldap-auth (I built apr/apr-util separately from CVS and linked
> both svn and apache against the same apr).
>
> Then put something like this into httpd.conf
>
> <Location /svn>
> DAV svn
> SVNPath /path/to/repo
>
> AuthLDAPURL
> ldap://myserver/CN=Users,DC=isolution,DC=idx,DC=com?sAMAccountName?sub?(objectClass=user)
> AuthLDAPBindDN "ISOLUTION\danello"
> AuthLDAPBindPassword XXXXXX
> AuthType Basic
> AuthName "LDAP Test"
> Require valid-user
> </Location>
>
> In this example, isolution.idx.com is the ActiveDirectory domain,
> ISOLUTION is the NT domain, and myserver is the ActiveDirectory server
> for my domain. The user danello has permissions to browse the
> ActiveDirectory.
>
> Good luck!
>
> -Dominic
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Managing users
Posted by Dominic Anello <da...@danky.com>.
On 2004-02-16 09:32:52 -0600, Justin Johnson wrote:
> I don't doubt that it may work well. The lack of support is more what
> I'm concerned about. From my research it seemed the code wasn't
> maintained by anyone anymore. Also, I'd prefer to run the server on a
> UNIX box.
>
> Thanks for the info though.
> -Justin
> On Mon, 16 Feb 2004 16:09:33 +0100, "Carsten Schurig"
> <cs...@ebz-dresden.de> said:
> > Justin Johnson <ma...@fastmail.fm> wrote on Monday,
> > February 16, 2004 3:56 PM:
> >
> >
> > > I'm looking for the easiest way to manage (add/remove) subversion
> > > users. I was hoping to find some way to hook into their NT login and
> > > password via the domain controllor, but the current method (sspi,
> > > etc) seems rather unsupported/unmaintained, so I don't feel
> > > comfortable going in that direction.
> >
> > I'm using this option and it works well. For that I've installed apache
> > on our Win2K server. I configured it to listen for https:// on a
> > non-standard port and not to listen on any other ports. I don't know if
> > you can setup apache on a Linux or any other unix machine and do a
> > password lookup on a windows DC.
> >
> > Cheers,
> > Carsten
Funny, I just solved this problem this morning using LDAP.
You have to be running an ActiveDirectory domain for this to work.
Configure apr-util --with-ldap and apache with --enable-ldap and
--enable-ldap-auth (I built apr/apr-util separately from CVS and linked
both svn and apache against the same apr).
Then put something like this into httpd.conf
<Location /svn>
DAV svn
SVNPath /path/to/repo
AuthLDAPURL ldap://myserver/CN=Users,DC=isolution,DC=idx,DC=com?sAMAccountName?sub?(objectClass=user)
AuthLDAPBindDN "ISOLUTION\danello"
AuthLDAPBindPassword XXXXXX
AuthType Basic
AuthName "LDAP Test"
Require valid-user
</Location>
In this example, isolution.idx.com is the ActiveDirectory domain,
ISOLUTION is the NT domain, and myserver is the ActiveDirectory server
for my domain. The user danello has permissions to browse the
ActiveDirectory.
Good luck!
-Dominic
RE: Managing users
Posted by Justin Johnson <ju...@fastmail.fm>.
I don't doubt that it may work well. The lack of support is more what
I'm concerned about. From my research it seemed the code wasn't
maintained by anyone anymore. Also, I'd prefer to run the server on a
UNIX box.
Thanks for the info though.
-Justin
On Mon, 16 Feb 2004 16:09:33 +0100, "Carsten Schurig"
<cs...@ebz-dresden.de> said:
> Justin Johnson <ma...@fastmail.fm> wrote on Monday,
> February 16, 2004 3:56 PM:
>
>
> > I'm looking for the easiest way to manage (add/remove) subversion
> > users. I was hoping to find some way to hook into their NT login and
> > password via the domain controllor, but the current method (sspi,
> > etc) seems rather unsupported/unmaintained, so I don't feel
> > comfortable going in that direction.
>
> I'm using this option and it works well. For that I've installed apache
> on our Win2K server. I configured it to listen for https:// on a
> non-standard port and not to listen on any other ports. I don't know if
> you can setup apache on a Linux or any other unix machine and do a
> password lookup on a windows DC.
>
> Cheers,
> Carsten
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
> For additional commands, e-mail: users-help@subversion.tigris.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
RE: Managing users
Posted by Carsten Schurig <cs...@ebz-dresden.de>.
Justin Johnson <ma...@fastmail.fm> wrote on Monday,
February 16, 2004 3:56 PM:
> I'm looking for the easiest way to manage (add/remove) subversion
> users. I was hoping to find some way to hook into their NT login and
> password via the domain controllor, but the current method (sspi,
> etc) seems rather unsupported/unmaintained, so I don't feel
> comfortable going in that direction.
I'm using this option and it works well. For that I've installed apache
on our Win2K server. I configured it to listen for https:// on a
non-standard port and not to listen on any other ports. I don't know if
you can setup apache on a Linux or any other unix machine and do a
password lookup on a windows DC.
Cheers,
Carsten
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org