0

I have a debian server i use for hosting subversion over https/apache2 also want to use this same server for my home file share (samba) for things like sensitive financial documents, etc. I'm hosting svn with apache2, and obviously will not use the same directory for my fileshare - What are the security concerns to be aware of with this type of configuration?

4 Answers 4

2

First and foremost, if the SVN server gets compromised those sensitive financial documents will be very easy to get. Much easier than if they were hosted on a separate device. This kind of set up is not recommended at all. If you have to do it, I'd seriously look at trying to get the apache/svn setup into some kind of Mandatory Access Control system like AppArmor or Tomoyo to help better contain any evil that may creep in.

1
  • ok i thought it might be a little crazy to consider this approach just wanted to get thoughts of others. Thanks for the quick feedback.
    – Tone
    Jul 31, 2010 at 21:05
0

Are you behind a firewall?

Are you running any type of IDS/IPS?

I personally think you're crazy for considering this, but to each his/her own...

1
  • I'm behind a dsl modem and a linksys router - do i need to consider either a hardware or software firewall? I'm hosting svn over https using a dynamic dns server for the dynamic ip i get from my isp.
    – Tone
    Jul 31, 2010 at 21:13
0

In theory, it should be fine, if you separately configure each correctly and keep them updated. Each service should handle authentication on its respective ports (SAMBA 137-139, and HTTP 80). Apache should be running as nobody so it shouldn't have access to your SMB files. However, I would still feel slightly uncomfortable about the dual purpose machine. If either SVN or Apache were compromised, it could provide access to your private data.

0

I really don't think this is a good idea.

The best suggestion I have would be to run the externally visible server and the internal server on two different PC's - get a used or barebones (Atom?) system which should be less than $300. Next best would be to run the externally visible server on a virtual machine hosted on the internally visible server.

The problem with either approach is that if you've only got one external IP, you're going to have to put both boxes on the same internal network, which means that when someone compromises the external server, they've got root on a machine on your internal network, which means they can (with some effort) see all internal network traffic and look like an internal client, and attack the internal machine(s) at LAN speeds with no firewall in between.

If you could get two external IP's, then the external box doesn't need to be on the wrong side of the firewall, and it would be much safer.

1
  • unfortunately i only have 1 ip, not sure if i can get another one. I'm starting to think a better plan is to move this to rackspace - I just need to justify the $30 a month for a linux instance in rackspace... thanks for the thoughts.
    – Tone
    Aug 17, 2010 at 17:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .