I have inherited a Fedora 17 server that is used to host Subversion repositories.
I thought it was configured with very limited access, but some tests today reveal that there is no access control at all, universal RW, oops.
Here is some info from the system:
Linux 3.9.10-100.fc17.x86_64 #1 SMP Sun Jul 14 01:31:27 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
Server version: Apache/2.2.23 (Unix) Server built: Jan 29 2013 12:37:17
Here is a snippet of part of the HTTPD configuration files
<Location /svn/proj> DAV svn SVNParentPath /data/subversion/repos/proj SVNAutoversioning On SSLRequireSSL SVNIndexXSLT "/repostyle-proj/view/repos.xsl" AuthType Basic AuthName "Project Authorization" PerlAuthenHandler Apache::AuthPOP3 PerlSetVar MailHost 127.0.0.1 AuthBasicAuthoritative On AuthzSVNAccessFile /data/subversion/conf/perms_proj Require valid-user SVNAdvertiseV2Protocol Off </Location>
Here is a snippet of the SVN permissions file
[groups] admins=admin-user dummy-proj=<list of users> [/] @admins=rw [dummy-proj:/] @dummy-proj=rw
I get full access to the repository even though I am authenticating as a user that is not the 'admin-user', or a user in the 'list of users'.
What have I got configured incorrectly?
More info - added on 4/18/17 11:00 AM
It appears that the files specified in the 'AuthzSVNAccessFile' lines are either not being read, or are being completely ignored.
To test, I renamed the file then accessed the repository with no problems. I also deleted that line from the config file and was still able to access the repository.
How can I get some debugging from AuthzSVN? I want to see the username it is validating against, and confirm that the file is being read.
Thanks for any help