You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Marko Käning <mk...@mch.osram.de> on 2008/07/24 15:19:30 UTC
SVN+SSH access not advisable
Hi,
I read in the SVN book that it is in principle not advisable to allow
multiple users to access a repo simultaneously via SVN+SSH.
My question: How critical is this in reality. We worked for a couple of
years in such a mode and never met any problem.
Perhaps this is only troublesome if you try to check in changes with lots
of users and heavy load for the machine running all the single svn
instances on ssh login shells?
We never had corruption due to SVN+SSH (say 3-4 computers committing to
the repos, only 2 had a chance to commit within the same second), so
what is the big drawback?
Am I right if I assume that we got spared trouble just because of the low
possibility of access to the repo at the exact same time?
Marko
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
RE: SVN+SSH access not advisable
Posted by Marko Käning <mk...@mch.osram.de>.
> It is not forbidden, but: Theoretically every user has the
> file-access-rights to destroy the entire repository (or alter history,
> circumvent hooks) Worst case: You lose your repository if a user (or
> virus) misbehaves (Probably even worse: Someone changes subversion
> history without leaving a trace)
OK, but assuming one works together and one doesn't want to destroy common
work this danger is quite small! :)
> The recommended setups use 'separation of rights' to provide only repository
> access to the repository.
> Worst case: All files in the repository are deleted, but all history is
> preserved (And a few 'svn cp' commands restore everything, preserving
> history)
Well, right. That's of course the safest scenario.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
RE: SVN+SSH access not advisable
Posted by Bert Huijben <be...@vmoo.com>.
> -----Original Message-----
> From: Marko Käning <mk...@mch.osram.de> [mailto:=?ISO-8859-
> 1?Q?Marko_K=E4ning_<mk...@mch.osram.de>?=]
> Sent: vrijdag 25 juli 2008 13:08
> To: Paul Koning
> Cc: users@subversion.tigris.org
> Subject: Re: SVN+SSH access not advisable
>
> > That doesn't sound right. What exactly does it say, and where does
> it
> > say it? I can't find anything like this.
>
> Well, see Chapter six of the 1.4 SVN book on page 144:
>
> <qote>
> If you have an existing infrastructure heavily based on SSH accounts,
> and
> if your users already have system accounts on your server machine, then
> it
> makes sense to deploy an svnserve-over-ssh solution. Otherwise, we
> don't
> widely recommend this option to the public. It's generally considered
> safer to have your users access the repository via (imaginary) accounts
> managed by svnserve or Apache, rather than by full-blown system
> accounts.
> If your deep desire for encrypted communication still draws you to this
> option, we recommend using Apache with SSL instead.
> </quote>
>
> My users must be members of a certain group. This groups gets full
> write
> access to the corresponding repository files. So everything (seems) to
> work fine. Perhaps it only seems so?
>
> Perhaps I read the above in a wrong way: it is not recommended, but
> perhaps it doesn't mean that it is forbidden...
It is not forbidden, but: Theoretically every user has the
file-access-rights to destroy the entire repository (or alter history,
circumvent hooks)
Worst case: You lose your repository if a user (or virus) misbehaves
(Probably even worse: Someone changes subversion history without leaving a
trace)
The recommended setups use 'separation of rights' to provide only repository
access to the repository.
Worst case: All files in the repository are deleted, but all history is
preserved (And a few 'svn cp' commands restore everything, preserving
history)
Bert
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SVN+SSH access not advisable
Posted by Stefan Sperling <st...@elego.de>.
On Fri, Jul 25, 2008 at 09:41:48AM -0500, Michael L Brown wrote:
> We use svn+rsh (in the building) and svn+ssh for those who work in the
> building and remotely.
>
> If someone was able to get a shell, so what. Why? Because they have an
> account and a login on the system anyway, so if they want a shell, they
> can get one by either doing rsh or ssh to any system on the internal LAN.
> The ssh login to SVN is not a SVN only use login.
>
> Using svn+rsh/svn+ssh has never given us any trouble.
>
> YMMV :-)
Yes, it depends. Where I employed ssh key restriction, we could
not easily run apache+https on the server, so we were forced to
use svn+ssh to get any form of encryption. That did not mean
that we wanted to give committers shells on the server though!
Stefan
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SVN+SSH access not advisable
Posted by Marko Käning <mk...@mch.osram.de>.
> His .ssh/autorized_keys looks like this:
> ---
> from="myclient.net", \
> command="svnserve -t --tunnel-user=USER", \
> no-port-forwarding, \
> no-agent-forwarding,no-X11-forwarding,no-pty \
> ssh-rsa ...KEY... COMMENT
> ---
Another argument in favour of a malfunction is that I can even get a ssh
shell if I do an "ssh myserver.net"...
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SVN+SSH access not advisable
Posted by Alan Barrett <ap...@cequrux.com>.
On Fri, 25 Jul 2008, Marko Käning wrote:
> His .ssh/autorized_keys looks like this:
> ---
> from="myclient.net", \
> command="svnserve -t --tunnel-user=USER", \
> no-port-forwarding, \
> no-agent-forwarding,no-X11-forwarding,no-pty \
> ssh-rsa ...KEY... COMMENT
If you really have all thsoe spaces and backslashes, then it's unlikely
to work. All that stuff needs to be on a single line, with the first
space being just before "ssh-rsa".
--apb (Alan Barrett)
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SVN+SSH access not advisable
Posted by Marko Käning <mk...@mch.osram.de>.
> I guess I'll test this approach too.
I did try it, but with limited success...
I created a svn-user named svnuser. In his homedir I created on the server
a repo only accessible to him (/home/svnuser/svntest).
His .ssh/autorized_keys looks like this:
---
from="myclient.net", \
command="svnserve -t --tunnel-user=USER", \
no-port-forwarding, \
no-agent-forwarding,no-X11-forwarding,no-pty \
ssh-rsa ...KEY... COMMENT
---
That the key ...KEY... is correctly assigned to the user svnuser I could
check when I did a checkout on my client via path
svn+ssh://svnuser@myserver.net/home/svnuser/svntest/trunk
Working on this copy is possible.
Drawback though: the author still shows up as svnuser, although option
--tunnel-user was set to USER!
I suspect that the command specified is not called correctly, since even
if I *misspell* svnserve the svn access doesn't fail...
What goes wrong here?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SVN+SSH access not advisable
Posted by Marko Käning <mk...@mch.osram.de>.
> server via ssh, force them to use key authentication and
> set the command to be run from the authorized_keys files
> of your users, by prepending a command= flag to every key in
> these files:
>
> command="/usr/bin/svnserve
> -t",no-agent-forwarding,no-X11-forwarding,no-port-forwarding ssh-rsa
> AAA....
yes, I see now in the manual that there is probably a much easier way to
allow multiple users access via this approach. Setting up only a single
account with multiple such lines like above plus the --tunnel-user option
is probably the better way to go, if you want to avoid setting up seperate
user accounts on the server for every single svn user...
I guess I'll test this approach too.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SVN+SSH access not advisable
Posted by Marko Käning <mk...@mch.osram.de>.
Hi Stefan,
> That's just saying "ssh might give your users a shell if not
> configured otherwise, but apache won't EVER do that'.
Ok, using ssh logins to access a repo is NOT a threat to its integrity.
Now that I think more of it, having in mind the locking mechanism
among several clients (no matter how they were set up) I begin to grab
the real meaning of that paragraph. So, I got that wrong. Thanks for this
clarification.
Regards,
Marko
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SVN+SSH access not advisable
Posted by Michael L Brown <mi...@philips.com>.
We use svn+rsh (in the building) and svn+ssh for those who work in the
building and remotely.
If someone was able to get a shell, so what. Why? Because they have an
account and a login on the system anyway, so if they want a shell, they can
get one by either doing rsh or ssh to any system on the internal LAN. The
ssh login to SVN is not a SVN only use login.
Using svn+rsh/svn+ssh has never given us any trouble.
YMMV :-)
MB
--
Mike Brown (Michael.L.Brown@Philips.com)
Blackberry: vidiot@uscellular.blackberry.com
Philips Medical, Fitchburg, WI
Desk: 608-288-6969 Fax: 608-298-2101
PMS direct: 164-6969
You design it, I'll build it!
To
Marko Käning <mk...@mch.osram.de>
cc
Stefan Sperling Paul Koning <Pa...@Dell.com>
<st...@elego.de> users@subversion.tigris.org
Subject
07/25/2008 08:55 AM Re: SVN+SSH access not advisable
Classification
On Fri, Jul 25, 2008 at 01:07:55PM +0200, Marko Käning wrote:
> > That doesn't sound right. What exactly does it say, and where does it
> > say it? I can't find anything like this.
>
> Well, see Chapter six of the 1.4 SVN book on page 144:
>
> <qote>
> If you have an existing infrastructure heavily based on SSH accounts, and
> if your users already have system accounts on your server machine, then
it
> makes sense to deploy an svnserve-over-ssh solution. Otherwise, we don't
> widely recommend this option to the public. It's generally considered
> safer to have your users access the repository via (imaginary) accounts
> managed by svnserve or Apache, rather than by full-blown system accounts.
> If your deep desire for encrypted communication still draws you to this
> option, we recommend using Apache with SSL instead.
> </quote>
>
> My users must be members of a certain group. This groups gets full write
> access to the corresponding repository files. So everything (seems) to
> work fine. Perhaps it only seems so?
That's just saying "ssh might give your users a shell if not
configured otherwise, but apache won't EVER do that'.
If you don't want users to be able to launch a shell on the
server via ssh, force them to use key authentication and
set the command to be run from the authorized_keys files
of your users, by prepending a command= flag to every key in
these files:
command="/usr/bin/svnserve
-t",no-agent-forwarding,no-X11-forwarding,no-port-forwarding ssh-rsa
AAA....
Stefan
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SVN+SSH access not advisable
Posted by Stefan Sperling <st...@elego.de>.
On Fri, Jul 25, 2008 at 01:07:55PM +0200, Marko Käning wrote:
> > That doesn't sound right. What exactly does it say, and where does it
> > say it? I can't find anything like this.
>
> Well, see Chapter six of the 1.4 SVN book on page 144:
>
> <qote>
> If you have an existing infrastructure heavily based on SSH accounts, and
> if your users already have system accounts on your server machine, then it
> makes sense to deploy an svnserve-over-ssh solution. Otherwise, we don't
> widely recommend this option to the public. It's generally considered
> safer to have your users access the repository via (imaginary) accounts
> managed by svnserve or Apache, rather than by full-blown system accounts.
> If your deep desire for encrypted communication still draws you to this
> option, we recommend using Apache with SSL instead.
> </quote>
>
> My users must be members of a certain group. This groups gets full write
> access to the corresponding repository files. So everything (seems) to
> work fine. Perhaps it only seems so?
That's just saying "ssh might give your users a shell if not
configured otherwise, but apache won't EVER do that'.
If you don't want users to be able to launch a shell on the
server via ssh, force them to use key authentication and
set the command to be run from the authorized_keys files
of your users, by prepending a command= flag to every key in
these files:
command="/usr/bin/svnserve -t",no-agent-forwarding,no-X11-forwarding,no-port-forwarding ssh-rsa AAA....
Stefan
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SVN+SSH access not advisable
Posted by Marko Käning <mk...@mch.osram.de>.
> That doesn't sound right. What exactly does it say, and where does it
> say it? I can't find anything like this.
Well, see Chapter six of the 1.4 SVN book on page 144:
<qote>
If you have an existing infrastructure heavily based on SSH accounts, and
if your users already have system accounts on your server machine, then it
makes sense to deploy an svnserve-over-ssh solution. Otherwise, we don't
widely recommend this option to the public. It's generally considered
safer to have your users access the repository via (imaginary) accounts
managed by svnserve or Apache, rather than by full-blown system accounts.
If your deep desire for encrypted communication still draws you to this
option, we recommend using Apache with SSL instead.
</quote>
My users must be members of a certain group. This groups gets full write
access to the corresponding repository files. So everything (seems) to
work fine. Perhaps it only seems so?
Perhaps I read the above in a wrong way: it is not recommended, but
perhaps it doesn't mean that it is forbidden...
:)
Regards,
Marko
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SVN+SSH access not advisable
Posted by Paul Koning <Pa...@dell.com>.
>>>>> "Marko" == Marko Käning <mk...@mch.osram.de> writes:
Marko> Hi, I read in the SVN book that it is in principle not
Marko> advisable to allow multiple users to access a repo
Marko> simultaneously via SVN+SSH.
That doesn't sound right. What exactly does it say, and where does it
say it? I can't find anything like this.
paul
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org