You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Eric <sp...@internetsmallfry.com> on 2011/04/01 22:32:26 UTC
Logging repository accesses other than commits
Is there a way to maintain a log of accesses to the repository other
than commits? Basically anything that results in incrementing the
revision number gets logged, but how do I log the event when a user
downloads or checks out something from the repository?
Thanks...
Re: Logging repository accesses other than commits
Posted by Daniel Shahaf <d....@daniel.shahaf.name>.
Nico Kadel-Garcia wrote on Sat, Apr 02, 2011 at 12:23:15 -0400:
> Here's the Red Hat published bug report on it, that goes into more
> detail and workaround attempts, back at Fedora 9 and the change from
> OpenSSH 5.0p1 to OpenSSH 5.1p1.
>
> https://bugzilla.redhat.com/show_bug.cgi?id=458839
>
> The key is here:
>
> The .bashrc should be read by bash only when the shell is
> interactive or when the stdin is a socket. In the 5.0p1 and older
> versions the stdin was socket but that caused other problems. Now the
> stdin is pipe and thus the .bashrc is not read
>
> This looks like a consequence of a reasonable change in sshd, but it's
> caused issues. And the funky flipping workarounds proposed to restore
> this behavior quietly ignore the basic principle of "do *NOT* read
> .bashrc for non-login sessions" which is right in the bash
> documentation.
Thanks for the summary, now I understand what the change and issue are.
Re: Logging repository accesses other than commits
Posted by Nico Kadel-Garcia <nk...@gmail.com>.
[ This conversation was accidentally in private email for a bit, I'm
restoring it to the Subversion mailing list. ]
On Sat, Apr 2, 2011 at 9:11 AM, Daniel Shahaf <d....@daniel.shahaf.name> wrote:
> Nico Kadel-Garcia wrote on Sat, Apr 02, 2011 at 08:48:39 -0400:
>> On Sat, Apr 2, 2011 at 1:24 AM, Daniel Shahaf <d....@daniel.shahaf.name> wrote:
>> > Nico Kadel-Garcia wrote on Sat, Apr 02, 2011 at 01:00:46 -0400:
>> >> On Sat, Apr 2, 2011 at 12:52 AM, Daniel Shahaf <d....@daniel.shahaf.name> wrote:
>> >> > Nico Kadel-Garcia wrote on Fri, Apr 01, 2011 at 23:46:16 -0400:
>> >> >> Modern versions of OpenSSH (such as the version 5 in RHEL 6 and
>> >> >> contemporary Debian releases) does not read your .bashrc for non-login
>> >> >> sessions. (This is actually standards compliant behavior, which
>> >> >> OpenSSH version 4 did not follow.)
>> >> >
>> >> > Are you describing a change in sshd or in bash?
>> >>
>> >> sshd. I ran headlong into this in RHEL 5 to RHEL 6 migration.
>> >> Environment variables like aliases and PATH were not being picked up,
>> >> due to this behaviorial change.
>> >>
>> >
>> > Thanks for the details.
>> >
>> > I assume the difference is that sshd stopped running $SHELL as a login
>> > shell, which in turn caused bash to not read .bashrc?
>>
>> I understand that it violated POSIX spec, and people didn't notice or
>> make a big deal of it for some time. Amusingly, as I dig through
>> Google for references to it, I see that I'm the one who keeps
>> referring to this issue as a problem and showing up in various
>> threads, and am having difficulty finding the spec.
>>
>
> Isn't it supposed to live on opengroup.org?
Have you ever tried reading through those with a particular small
question in mind? It takes a while.
Here's the Red Hat published bug report on it, that goes into more
detail and workaround attempts, back at Fedora 9 and the change from
OpenSSH 5.0p1 to OpenSSH 5.1p1.
https://bugzilla.redhat.com/show_bug.cgi?id=458839
The key is here:
The .bashrc should be read by bash only when the shell is
interactive or when the stdin is a socket. In the 5.0p1 and older
versions the stdin was socket but that caused other problems. Now the
stdin is pipe and thus the .bashrc is not read
This looks like a consequence of a reasonable change in sshd, but it's
caused issues. And the funky flipping workarounds proposed to restore
this behavior quietly ignore the basic principle of "do *NOT* read
.bashrc for non-login sessions" which is right in the bash
documentation.
>> But you can find the details of how and when .bashrc is read with the
>> 'info bash' command, and it is explicitly *not* supposed to read
>> .bashrc for non-login shells. In theory, one might be able to
>> manipulate hte sshd_config daemon settings to use
>> PermitUserEnvironment, or enable that for specific users such as a
>> designated 'svn' user for shared svn+ssh access, but this is getting
>> seriously arcane.
>
> Thanks for the reply, but it doesn't answer my question: I know how to
> 'man bash' myself [1], but I simply asked if you knew what change was
> made to sshd...
See above.
> IOW, I understand that some change in the way sshd invokes $SHELL caused
> bash to stop reading its .bashrc, but I don't know what that change is.
>
> (I don't see any relevant mentions of 'login shell' in openssh's ChangeLog)
>
>
>
> [1] Incidentally, I read just that section of it that the other day
> in response to someone's question about scp and umask in their rc file.
>
Re: Logging repository accesses other than commits
Posted by Daniel Shahaf <d....@daniel.shahaf.name>.
Nico Kadel-Garcia wrote on Fri, Apr 01, 2011 at 23:46:16 -0400:
> On Fri, Apr 1, 2011 at 10:09 PM, Daniel Shahaf <d....@daniel.shahaf.name> wrote:
> > Doesn't 'svnserve --log-file' handle this?
> >
> > Clients run 'ssh $host svnserve -t' by default, so you'd have to make
> > that invocation spawn an svnserve that has --log-file passed to it. You
> > could alter the svnserve in $PATH or use sshd configuration
> > (ForceCommand and command="" directives) to achieve that.
>
> Great. The "--log-file" option is not in the manual page. Time for a
> bug report.
>
Or a patch.
(Good catch, though.)
> Modern versions of OpenSSH (such as the version 5 in RHEL 6 and
> contemporary Debian releases) does not read your .bashrc for non-login
> sessions. (This is actually standards compliant behavior, which
> OpenSSH version 4 did not follow.)
Are you describing a change in sshd or in bash?
zsh does read .zshenv under current Debian's sshd.
> This makes stashing an svnserve
> alias or $PATH setting unavailable going forward, and dependent on the
> typically shared 'svn' user to have this set in their path for
> svn+ssh.
>
> ForceCommand looks like it will *break* ordinary svn+ssh, without
True. You could allow shell access if you took other steps to prevent
users from running 'cat' or (--log-file)-less 'svnserve' on the repository.
> using the SSH_ORIGINAL_COMMAND environment variable. Interesting. It
> would take fascinating parsing, and awkward configuration with managed
> SSH keys, but it's vaguely feasible.
>
> That looks...... really awkward to manage, and without any graceful
> SSH key management tools for Subversion access, it becomes a alocal
> and manually managed setup, and requires the manipulation of the SSH
> daemon's sshd_config. That's not very modular.
Replacing /usr/bin/svnserve by a 2-line wrapper script works too.
Re: Logging repository accesses other than commits
Posted by David Brodbeck <br...@uw.edu>.
On Fri, Apr 1, 2011 at 8:46 PM, Nico Kadel-Garcia <nk...@gmail.com> wrote:
> Modern versions of OpenSSH (such as the version 5 in RHEL 6 and
> contemporary Debian releases) does not read your .bashrc for non-login
> sessions. (This is actually standards compliant behavior, which
> OpenSSH version 4 did not follow.) This makes stashing an svnserve
> alias or $PATH setting unavailable going forward, and dependent on the
> typically shared 'svn' user to have this set in their path for
> svn+ssh.
>
I hit this same behavior working with a git install on a nonstandard path, a
while back.
One solution, at least on Linux, is to set "UsePAM Yes" in your sshd_config
and include "auth required pam_env.so" in the PAM settings for sshd. (This
is the default in many distributions.) You can then configure your custom
PATH in /etc/environment, and it *will* get read by non-interactive SSH
sessions. Note that /etc/environment is not a shell script; the only things
you can put in there are comments and simple variable assignments.
~/.ssh/environment is also an option. You have to turn on
PermitUserEnvironment in sshd_config for that to work.
--
David Brodbeck
System Administrator, Linguistics
University of Washington
Re: Logging repository accesses other than commits
Posted by Nico Kadel-Garcia <nk...@gmail.com>.
On Fri, Apr 1, 2011 at 10:09 PM, Daniel Shahaf <d....@daniel.shahaf.name> wrote:
> Doesn't 'svnserve --log-file' handle this?
>
> Clients run 'ssh $host svnserve -t' by default, so you'd have to make
> that invocation spawn an svnserve that has --log-file passed to it. You
> could alter the svnserve in $PATH or use sshd configuration
> (ForceCommand and command="" directives) to achieve that.
Great. The "--log-file" option is not in the manual page. Time for a
bug report.
Modern versions of OpenSSH (such as the version 5 in RHEL 6 and
contemporary Debian releases) does not read your .bashrc for non-login
sessions. (This is actually standards compliant behavior, which
OpenSSH version 4 did not follow.) This makes stashing an svnserve
alias or $PATH setting unavailable going forward, and dependent on the
typically shared 'svn' user to have this set in their path for
svn+ssh.
ForceCommand looks like it will *break* ordinary svn+ssh, without
using the SSH_ORIGINAL_COMMAND environment variable. Interesting. It
would take fascinating parsing, and awkward configuration with managed
SSH keys, but it's vaguely feasible.
That looks...... really awkward to manage, and without any graceful
SSH key management tools for Subversion access, it becomes a alocal
and manually managed setup, and requires the manipulation of the SSH
daemon's sshd_config. That's not very modular.
Re: Logging repository accesses other than commits
Posted by Daniel Shahaf <d....@daniel.shahaf.name>.
Doesn't 'svnserve --log-file' handle this?
Clients run 'ssh $host svnserve -t' by default, so you'd have to make
that invocation spawn an svnserve that has --log-file passed to it. You
could alter the svnserve in $PATH or use sshd configuration
(ForceCommand and command="" directives) to achieve that.
Nico Kadel-Garcia wrote on Fri, Apr 01, 2011 at 21:45:47 -0400:
> On Fri, Apr 1, 2011 at 5:03 PM, Eric <sp...@internetsmallfry.com> wrote:
> > At 04:51 PM 4/1/2011, Chris Shelton wrote:
> >
> >>>>>>
> >>
> >> If you are using apache for serving your repository,
> >
> > <<<<<
> >
> > Good afternoon, Chris.
> >
> > We're not... we're using svn+ssh exclusively.
>
> This is trickier. You can log the existence of the connections based
> on the account used, particularly if you use a shared user, and
> especially if you run sshd on a non-standard port with distinct logs.
> So you can do some connection tracking. But svnserve does *NO* logging
> of read operations, so once you have the SSH tunnel established, it's
> a complete black box.
>
> That would actually make a good feature request, and with the new
> commercial sponsors of Subversion, they might be cooperative with such
> a feature request. But I wouldn't expect it in the planned subversion
> 1.7 release.
Re: Logging repository accesses other than commits
Posted by Nico Kadel-Garcia <nk...@gmail.com>.
On Fri, Apr 1, 2011 at 5:03 PM, Eric <sp...@internetsmallfry.com> wrote:
> At 04:51 PM 4/1/2011, Chris Shelton wrote:
>
>>>>>>
>>
>> If you are using apache for serving your repository,
>
> <<<<<
>
> Good afternoon, Chris.
>
> We're not... we're using svn+ssh exclusively.
This is trickier. You can log the existence of the connections based
on the account used, particularly if you use a shared user, and
especially if you run sshd on a non-standard port with distinct logs.
So you can do some connection tracking. But svnserve does *NO* logging
of read operations, so once you have the SSH tunnel established, it's
a complete black box.
That would actually make a good feature request, and with the new
commercial sponsors of Subversion, they might be cooperative with such
a feature request. But I wouldn't expect it in the planned subversion
1.7 release.
Re: Logging repository accesses other than commits
Posted by Eric <sp...@internetsmallfry.com>.
At 04:51 PM 4/1/2011, Chris Shelton wrote:
>>>>>
>If you are using apache for serving your repository,
<<<<<
Good afternoon, Chris.
We're not... we're using svn+ssh exclusively.
Re: Logging repository accesses other than commits
Posted by Chris Shelton <cs...@shelton-family.net>.
Eric,
On Fri, Apr 1, 2011 at 4:32 PM, Eric <sp...@internetsmallfry.com> wrote:
>
> Is there a way to maintain a log of accesses to the repository other than commits? Basically anything that results in incrementing the revision number gets logged, but how do I log the event when a user downloads or checks out something from the repository?
>
If you are using apache for serving your repository, this is fairly
straightforward with an extra CustomLog directive in your httpd.conf
file. See:
http://svnbook.red-bean.com/nightly/en/svn.serverconfig.httpd.html#svn.serverconfig.httpd.extra.logging
for details.
chris