Re: How to test that I configured httpd+Subversion wirh Path Based Authorization in the right way?

On Jan 14, 7:20 am, Andrea Francia
<afran...@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
wrote:
The problem is about security settings of the Subversion repository
served trough the Apache web server.

Do not use this technique, *EVER*, for accessing Subversion
repositories, except for anonymous access.

The major problem is that the UNIX and Linux default command-line
client, 'svn', stores all passwrds locally in cleartext. The extent to
which this is an incredibly bad idea is stunning. And as the
Subversion administrator, you have no way to prevent your users from
ever using the command line client.

The only fix directly supported for Subversion is to use svn+ssh for
secure, remote access, and that fix is limited due to people's
tendency to use SSH keys without passphrases and store them casually.
It's a long-standing set of security issues: I'm looking into 'git'
right now as a possible separate approach.
.

Quantcast