Mailing-List: contact users-help@subversion.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (athena.apache.org: domain of nkadel@gmail.com designates
 209.85.216.43 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type;
        b=KabqdpZd/y1aBXscfir/Ezkr72XRGg6+3Yy7X0z9sXcHVny9o5ERN8wVL/d3q72j9f
         KwPRp/H13mWbc9br+6NXlU6yKEHycptrXJGMoPNBZPg/56FGcJYwJgj8YEEHt2G4ZgCb
         z61iIwFMpdX3j/YHOieBw6g09jpHG/smze8vA=
MIME-Version: 1.0
In-Reply-To: <4D21FD6D.2060505@gmail.com>
References: <AANLkTik0+NKvxnoYYBnAfhMsZuSagQg5v8YecZviHJnb@mail.gmail.com>
	<4D21FD6D.2060505@gmail.com>
Date: Tue, 4 Jan 2011 21:43:23 -0500
Message-ID: <AANLkTikf2h6bLoZp59r8hMzVSgVsRoUJM6kCyazvKT2V@mail.gmail.com>
Subject: Re: Fine and secure dining, was Re: svnadmin create and not being
 method agnostic
From: Nico Kadel-Garcia <nkadel@gmail.com>
To: Les Mikesell <lesmikesell@gmail.com>
Cc: users@subversion.apache.org
Content-Type: text/plain; charset=ISO-8859-1

On Mon, Jan 3, 2011 at 11:46 AM, Les Mikesell <lesmikesell@gmail.com> wrote:
> On 1/2/2011 9:43 PM, Nico Kadel-Garcia wrote:
>>
>> It's possible to do secure Subversion. Use svn+ssh access, disable or
>> block other services at the firewall,
>
> If ssh is permitted and you didn't personally set it up, what are the odds
> that port tunneling or ssh's built in socks proxy will allow access to every
> service behind the firewall?

It's not ideal: a dedicated shell (such as gitshell) would be
preferable, but there are intelligent tools such as gitosis for
enabling and configuring just such a service. It need only be open for
the single "svn" dedicated user that holds the SSH keys, and the
authorized_keys can be set to restrict commands usable by that SSH key
access to a single command. This is why Kerberized access to such an
svnserve service account is not workable: it's permitted operations
cannot be so limited as the SSH key technology.

It would still be somewhat better than the current setup if that user
used "rssh", but I've not personally succeeded in integrating
Subversion support into that toolkit.