1

I have inherited a Fedora 17 server that is used to host Subversion repositories.

I thought it was configured with very limited access, but some tests today reveal that there is no access control at all, universal RW, oops.

Here is some info from the system:

uname -a

Linux 3.9.10-100.fc17.x86_64 #1 SMP Sun Jul 14 01:31:27 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

httpd -v

Server version: Apache/2.2.23 (Unix) Server built: Jan 29 2013 12:37:17

Here is a snippet of part of the HTTPD configuration files

<Location /svn/proj>
    DAV                             svn
    SVNParentPath                   /data/subversion/repos/proj
    SVNAutoversioning               On
    SSLRequireSSL
    SVNIndexXSLT                    "/repostyle-proj/view/repos.xsl"
    AuthType                        Basic
    AuthName                        "Project Authorization"
    PerlAuthenHandler               Apache::AuthPOP3
    PerlSetVar                      MailHost 127.0.0.1
    AuthBasicAuthoritative          On
    AuthzSVNAccessFile              /data/subversion/conf/perms_proj
    Require valid-user
    SVNAdvertiseV2Protocol Off

</Location>

Here is a snippet of the SVN permissions file

[groups]
admins=admin-user
dummy-proj=<list of users>

[/]
@admins=rw

[dummy-proj:/]
@dummy-proj=rw

When running

svn co https://FQDN/svn/proj/dummy-proj/

I get full access to the repository even though I am authenticating as a user that is not the 'admin-user', or a user in the 'list of users'.

What have I got configured incorrectly?

More info - added on 4/18/17 11:00 AM

It appears that the files specified in the 'AuthzSVNAccessFile' lines are either not being read, or are being completely ignored.

To test, I renamed the file then accessed the repository with no problems. I also deleted that line from the config file and was still able to access the repository.

How can I get some debugging from AuthzSVN? I want to see the username it is validating against, and confirm that the file is being read.

Thanks for any help

  • Fedora 17 is EOL for years. You should update to supported version. Such old system can have many security vulnerabilities. – Jakuje Apr 16 '17 at 7:36
0

I learned from here that permissions on SVN are different between the svn:// protocol and the http(s):// protocol. Lovely.

Your SVN HTTP permissions probably come from your web server, which might be Apache, Lighttpd, nginx, etc. See here: http://svnbook.red-bean.com/nightly/en/svn.serverconfig.httpd.html

Basically you need to:

  • Find out which web server you're using to host the http(s) endpoint for SVN
  • Determine what authentication mechanism is being used by that web server, if any
  • Lock it down if no authentication, by implementing, e.g. Windows/LDAP auth, PAM auth, Basic auth, or Digest auth, then set a web-server-specific permission per user/group
  • Just to ensure maximum confusion, verify that you (probably) don't have those full R/W access rights if you svn co svn:// (using the SVN native protocol rather than HTTP).

BTW, this is unrelated to your question, but Fedora 17 hasn't been supported for security or bugfix updates in around 4 years, so you should really upgrade to a supported OS. RHEL/CentOS 7.x is based on Fedora 19 (with a lot of newer patches and backports for improved hardware support and stability), so because of the similarity between Fedora 17 and CentOS/RHEL 7.x, it would be a relatively low effort for you to save configuration files and data from the server and reinstall the OS as CentOS/RHEL 7.x. And then you'd start receiving a steady stream of security updates again for a number of years still (into about 2023).

If you encounter issues that resemble bugs or broken functionality in Fedora 17, almost no one is going to be at all motivated to assist you in any capacity, so that's another motivating reason to upgrade. If you find something broken in CentOS 7.x, and can write a good bug report, it might actually get fixed by Red Hat or a community contributor, and you could download the patch as a stable update. There's a big difference between running a supported and an unsupported OS, especially if you have a company relying on the correct functionality of this server. You're playing with fire if you have people getting important work done based on this server.

  • Hi @allquixotic, thanks for your response. As stated in the question, I am using Apache 2.2.23, and I thought AuthzSVN was being used to control authorization to access the repositories, but apparently it is not. I need help figuring how I've incorrectly configured the HTTPD conf files. Thanks. PS Yes, I know Fedora 17 and Apache 2.223 are old, and no longer supported, but I am stuck with them for now. – shifflettd Apr 14 '17 at 22:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.