{ "created": "2015-12-20T19:56:53Z", "hierarchy": [ { "name": "ROOT", "type": "folder", "uri": "/ROOT" }, { "name": "Subversion Installation and Configuration", "type": "article", "uri": "Subversion_Installation_and_Configuration" } ], "html": "\n\n \n \n \n \n \n \n \n \n \n \n \n Subversion Installation and Configuration – Nikhil's Personal Wiki\n \n \n \n \n \n
\n
\n \n
\n
\n \n \n\n

Subversion Installation and Configuration\n \n

\n

[TOC]

\n

Host is svn.example.com. There are basically two ways of serving up
\na subversion repository. One uses svnserve, a lightweight server
\n(default port 3690). The other is leveraging Apache (httpd) via the
\nWebDAV protocol.

\n

The latter is more complex. But it is extremely flexible in terms of
\nadministration and is the basis for this setup guide. I will be setting
\nup a single repository at https://svn.example.com/repository with SSL,
\nLDAP-based authentication, and project-specific access control.

\n

Installation

\n

Getting the RPM

\n

I’m putting the SVN root in /home/svn as well. This can be anywhere.

\n
yum install subversion mod_dav_svn\n
\n

This will install Apache and other dependencies as well.

\n
service httpd start  \nchkconfig --level 345 httpd on\n
\n

Make sure it’s working, and that iptables is not causing any issues.
\nYou can use nmap for this purpose or just go to
\nhttp://svn.example.com.

\n

Preparing subversion.conf

\n

Installing the packages will create a new apache configuration directive
\nin /etc/httpd/conf.d called subversion.conf. You need to edit this
\nfile to set up the location of the repository.

\n

First uncomment these files if they’ve not been uncommented:

\n
LoadModule dav_svn_module     modules/mod_dav_svn.so  \nLoadModule authz_svn_module   modules/mod_authz_svn.so\n
\n

Define the SVN root:

\n
<Location /repository>  \n        DAV svn  \n        SVNPath /home/svn/repository  \n</Location>\n
\n

Now you can add simple authentication or use LDAP.

\n

Configuration

\n

Simple Authentication

\n

This uses basic htpasswd based authentication. Passwords may be sent
\nin the clear if you don’t enable SSL. You can also use digest-based
\nauthentication which is slightly more secure.

\n

For this scheme, our /etc/httpd/conf.d/subversion.conf file will have
\nthe following directive:

\n
<Location /repository>  \n        DAV svn  \n        SVNPath /home/svn/repository  \n          \n        # Simple authentication  \n        AuthType Basic  \n        AuthName "SVN Server"  \n        AuthUserFile /home/svn/basic-authentication  \n        Require valid-user  \n</Location>\n
\n

Here, we use /home/svn/authorized-users to authenticate. Create this
\nfile and add a user with:

\n
[root@svn ~]# htpasswd -cm /home/svn/authorized-users testuser  \nNew password:   \nRe-type new password:   \nAdding password for user testuser\n
\n

Setting up the repository

\n
svnadmin create /home/svn/repository\n
\n

Make absolutely sure that Apache owns this directory and its
\ndescendants!

\n
chown -R apache:apache /home/svn/repository\n
\n

Testing the Configuration

\n

At this point, you should have a repo accessible via Apache, with
\npassword sent in clear text (we’ll change that). I went to
\nhttp://svn.example.com and saw the image to the right after entering
\nmy credentials for testuser.

\n

Excellent! Test it now! I tested this config with Eclipse (with the
\nSubclipse plugin.)

\n

Securing with SSL

\n

To secure stuff with SSL, generate or use a certificate and enable
\nApache with mod_ssl. Change subversion.conf so that all traffic on
\nport 80 is redirected to port 443 (which uses the certs we’ve created.)

\n
 <VirtualHost *:80>  \n         ServerName svn.example.com  \n         RewriteEngine On  \n         RewriteRule .* https://svn.example.com%{REQUEST_URI} [L,R=301]  \n </VirtualHost>\n
\n

Restart httpd and you’re good to go!

\n

LDAP integration

\n

In this example, I will be using directory.example.com as the (Open
\nDirectory-based) LDAP provider. Change the basic authentication scheme
\nto match this:

\n
 # # If using some CA file  \n # LDAPTrustedMode NONE    \n # LDAPTrustedGlobalCert CA_DER /etc/pki/tls/certs/root_ca.crt  \n # LDAPVerifyServerCert off\n\n # Define the repository location  \n <Location /repository>  \n         DAV svn  \n         SVNPath /home/svn/repository  \n   \n         # Integrate with LDAP server  \n         AuthType Basic  \n         AuthBasicProvider ldap  \n         AuthName "SVN Server"  \n         AuthzLDAPAuthoritative off  \n         AuthLDAPURL "(ldap://directory.example.com/cn=users,dc=directory,dc=example,dc=com?uid?sub)?(objectClass=*)"  \n         Require valid-user  \n         AuthzSVNAccessFile /home/svn/repository/conf/authz  \n </Location>\n
\n

It is important that you set AuthBasicProvider ldap. If not,
\nApache will look for a password file and not even bother to authenticate
\nagainst your LDAP server. You’ll also see something like this when
\nrestarting the httpd daemon:

\n
Invalid command 'AuthLDAPAuthoritative', perhaps misspelled or defined by a module not included in the server configuration\n
\n

I had terrible luck with setting AuthzLDAPAuthoritative to “on”. You
\ncan read the Apache mod_authnz_ldap page for more information on these
\ndirectives. They’re quite flexible when configuring multiple
\nrepositories, with respect to user and group access.

\n

Now that you have a single repository, you can fine tune access with the
\nAuthzSVNAccessFile directive. By default, and when you use
\nsvnadmin create, you get an authz file in your repository’s conf
\nfolder. In the Apache configuration above, it’s the file I’ve used to
\ntweak folder access.

\n

Project Management within a Repository

\n

Creating a project

\n

This is very simple. It’s vitally important that your project folder
\ncontains three sub-folders: trunk, branches and tags. All
\nthe code you want to check into the repository must be in trunk.

\n

Step 1: Create the required directory structure

\n
mkdir -p /tmp/newproject/{trunk,branches,tags}\n
\n

Step 2: Copy/move project files into trunk

\n
cp -R /path/to/project/files/* /tmp/newproject/trunk/\n
\n

Step 3: Perform the first commit

\n
cd /tmp\nsvn import newproject https://svn.example.com/repository/myproject --message "Initial import" --username myuser\n
\n

Observe that my project is called newproject on my local machine but
\nis myproject on the SVN server. You may or may not choose to do this,
\nbut the option is available.

\n

You may get a dialog about the certificate used to secure the
\ntransaction. Accept the key permanently. You will then be required to
\nsupply a password.

\n

Step 4: Working with your project

\n

Most typical CVS actions should apply (prefixed with an svn of
\ncourse.) For example, to check out the project created above.

\n
svn checkout https://username@svn.example.com/repository/myproject\n
\n

The Google teems with SVN cheatsheets.

\n

Modifying Access Control

\n

Important: Only root can do this. Talk to your friendly sysadmin for
\nproject-specific access control. By default, your newly created project
\nwill be world accessible (i.e. to all authenticated users.)

\n

Here’s an example where I created a folder for a rather sinister project
\ncalled thiswillendpoorly and have given write access only to user
\nnanand and read access to machrist. The leading slash is
\nimportant!

\n
# Deny world access to repository root (noone needs to get a project listing)  \n[/]  \n* =  \n  \n# Allow only Nikhil and Mark to access this terrible project (Mark can only read)  \n[/thiswillendpoorly]  \nnanand = rw  \nmachrist = r  \n* =\n
\n

If you had multiple repositories, you would need to:

\n\n

Here’s an example:

\n
[repository1:/path]  \nuser1 = rw  \nuser2 = r  \n  \n[repository2:/path]  \n* = rw\n
\n

If you specified a path without specifying the repository, the filter is
\napplied across all repositories! This is explained
\nhere.

\n

Miscellaneous

\n

Special note about LDAP groups

\n

You cannot do LDAP group-based authentication in SVN with the authz
\nfile. However, I’ve seen a python
\nscript which can import LDAP
\ngroups.

\n

Few pointers on multiple repository configuration

\n\n

Configuring for use with Self-Signed Certificates

\n

Assuming that your Root CA is called root_ca.crt. Create and edit
\n/etc/sysconfig/servers to add the following:

\n
[global]  \nssl-authority-files = /etc/pki/tls/certs/root_ca.crt\n
\n

The other option is to use the system-wide keystore at
\n/etc/pki/tls/certs/ca-bundle.crt by appending the ASCII version to the
\nend of this file.

\n

Resources

\n\n

Active Directory Integration

\n\n\n\n
\n \n
\n \n \n \n \n \n\n", "id": "5decb36b-7994-5d47-9853-b3ae27946d76", "modified": "2026-01-13T18:47:28Z", "revisions": [ { "authorEmail": "mail@nikhil.io", "authorName": "Nikhil Anand", "date": "2026-01-13T18:47:28Z", "id": "2436477560f26e23d00a24add1cbfeafdca4af78", "shortId": "24364775", "subject": "No compression\n", "content": "[TOC]\n\nHost is **svn.example.com**. There are basically two ways of serving up\na subversion repository. One uses `svnserve`, a lightweight server\n(default port 3690). The other is leveraging Apache (`httpd`) via the\nWebDAV protocol.\n\nThe latter is more complex. But it is extremely flexible in terms of\nadministration and is the basis for this setup guide. I will be setting\nup a single repository at `https://svn.example.com/repository` with SSL,\nLDAP-based authentication, and project-specific access control.\n\nInstallation\n------------\n\n### Getting the RPM\n\nI'm putting the SVN root in /home/svn as well. This can be anywhere.\n\n yum install subversion mod_dav_svn\n\nThis will install Apache and other dependencies as well.\n\n service httpd start \n chkconfig --level 345 httpd on\n\nMake sure it's working, and that `iptables` is not causing any issues.\nYou can use `nmap` for this purpose or just go to\n.\n\n### Preparing `subversion.conf`\n\nInstalling the packages will create a new apache configuration directive\nin `/etc/httpd/conf.d` called `subversion.conf`. You need to edit this\nfile to set up the location of the repository.\n\nFirst uncomment these files if they've not been uncommented:\n\n LoadModule dav_svn_module     modules/mod_dav_svn.so \n LoadModule authz_svn_module   modules/mod_authz_svn.so\n\nDefine the SVN root:\n\n \n         DAV svn \n         SVNPath /home/svn/repository \n \n\nNow you can add simple authentication or use LDAP.\n\nConfiguration\n-------------\n\n### Simple Authentication\n\nThis uses basic `htpasswd` based authentication. Passwords may be sent\nin the clear if you don't enable SSL. You can also use digest-based\nauthentication which is slightly more secure.\n\nFor this scheme, our `/etc/httpd/conf.d/subversion.conf` file will have\nthe following directive:\n\n \n         DAV svn \n         SVNPath /home/svn/repository \n          \n         # Simple authentication \n         AuthType Basic \n         AuthName \"SVN Server\" \n         AuthUserFile /home/svn/basic-authentication \n         Require valid-user \n \n\nHere, we use /home/svn/authorized-users to authenticate. Create this\nfile and add a user with:\n\n [root@svn ~]# htpasswd -cm /home/svn/authorized-users testuser \n New password:  \n Re-type new password:  \n Adding password for user testuser\n\n### Setting up the repository\n\n svnadmin create /home/svn/repository\n\nMake absolutely sure that Apache owns this directory and its\ndescendants!\n\n chown -R apache:apache /home/svn/repository\n\n### Testing the Configuration\n\nAt this point, you should have a repo accessible via Apache, with\npassword sent in clear text (we'll change that). I went to\n`http://svn.example.com` and saw the image to the right after entering\nmy credentials for testuser.\n\nExcellent! Test it now! I tested this config with Eclipse (with the\nSubclipse plugin.)\n\n### Securing with SSL\n\nTo secure stuff with SSL, generate or use a certificate and enable\nApache with `mod_ssl`. Change `subversion.conf` so that all traffic on\nport 80 is redirected to port 443 (which uses the certs we've created.)\n\n   \n          ServerName svn.example.com \n          RewriteEngine On \n          RewriteRule .* https://svn.example.com%{REQUEST_URI} [L,R=301] \n  \n\nRestart `httpd` and you're good to go!\n\n### LDAP integration\n\nIn this example, I will be using **directory.example.com** as the (Open\nDirectory-based) LDAP provider. Change the basic authentication scheme\nto match this:\n\n  # # If using some CA file \n  # LDAPTrustedMode NONE   \n  # LDAPTrustedGlobalCert CA_DER /etc/pki/tls/certs/root_ca.crt \n  # LDAPVerifyServerCert off\n\n  # Define the repository location \n   \n          DAV svn \n          SVNPath /home/svn/repository \n   \n          # Integrate with LDAP server \n          AuthType Basic \n          AuthBasicProvider ldap \n          AuthName \"SVN Server\" \n          AuthzLDAPAuthoritative off \n          AuthLDAPURL \"(ldap://directory.example.com/cn=users,dc=directory,dc=example,dc=com?uid?sub)?(objectClass=*)\" \n          Require valid-user \n          AuthzSVNAccessFile /home/svn/repository/conf/authz \n  \n\n**It is important** that you set `AuthBasicProvider ldap`. If not,\nApache will look for a password file and not even bother to authenticate\nagainst your LDAP server. You'll also see something like this when\nrestarting the `httpd` daemon:\n\n Invalid command 'AuthLDAPAuthoritative', perhaps misspelled or defined by a module not included in the server configuration\n\nI had terrible luck with setting `AuthzLDAPAuthoritative` to \"on\". You\ncan read the Apache `mod_authnz_ldap` page for more information on these\ndirectives. They're quite flexible when configuring multiple\nrepositories, with respect to user and group access.\n\nNow that you have a single repository, you can fine tune access with the\n`AuthzSVNAccessFile` directive. By default, and when you use\n`svnadmin create`, you get an `authz` file in your repository's `conf`\nfolder. In the Apache configuration above, it's the file I've used to\ntweak folder access.\n\nProject Management within a Repository\n--------------------------------------\n\n### Creating a project\n\nThis is very simple. It's vitally important that your project folder\ncontains three sub-folders: **trunk**, **branches** and **tags**. All\nthe code you want to check into the repository must be in **trunk**.\n\n#### Step 1: Create the required directory structure\n\n mkdir -p /tmp/newproject/{trunk,branches,tags}\n\n#### Step 2: Copy/move project files into `trunk`\n\n cp -R /path/to/project/files/* /tmp/newproject/trunk/\n\n#### Step 3: Perform the first commit\n\n cd /tmp\n svn import newproject https://svn.example.com/repository/myproject --message \"Initial import\" --username myuser\n\nObserve that my project is called `newproject` on my local machine but\nis `myproject` on the SVN server. You may or may not choose to do this,\nbut the option is available.\n\nYou may get a dialog about the certificate used to secure the\ntransaction. Accept the key permanently. You will then be required to\nsupply a password.\n\n#### Step 4: Working with your project\n\nMost typical CVS actions should apply (prefixed with an `svn` of\ncourse.) For example, to check out the project created above.\n\n svn checkout https://username@svn.example.com/repository/myproject\n\nThe Google teems with SVN cheatsheets.\n\n### Modifying Access Control\n\n**Important**: Only root can do this. Talk to your friendly sysadmin for\nproject-specific access control. By default, your newly created project\nwill be world accessible (i.e. to *all authenticated* users.)\n\nHere's an example where I created a folder for a rather sinister project\ncalled `thiswillendpoorly` and have given write access only to user\n`nanand` and read access to `machrist`. *The leading slash is\nimportant!*\n\n # Deny world access to repository root (noone needs to get a project listing) \n [/] \n * = \n \n # Allow only Nikhil and Mark to access this terrible project (Mark can only read) \n [/thiswillendpoorly] \n nanand = rw \n machrist = r \n * =\n\nIf you had multiple repositories, you would need to:\n\n* Change the Apache directive `SVNPath` to `SVNParentPath`\n* Specify the repository in the `authz` file\n\nHere's an example:\n\n [repository1:/path] \n user1 = rw \n user2 = r \n \n [repository2:/path] \n * = rw\n\nIf you specified a path without specifying the repository, the filter is\napplied across *all* repositories! This [is explained\nhere](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2).\n\nMiscellaneous\n-------------\n\n### Special note about LDAP groups\n\nYou cannot do LDAP group-based authentication in SVN with the `authz`\nfile. However, I've seen [a python\nscript](http://www.thoughtspark.org/node/26) which can import LDAP\ngroups.\n\n### Few pointers on multiple repository configuration\n\n* If you plan on hosting multiple repositories, you need to change\n `SVNPath` to \"SVNParentPath\".\n* *Apache will NOT allow you to access the root defined as\n `SVNParentPath`!* You need to create repositories using\n `svnadmin create` and can then access them through\n `http://svn.example.com/{path in SVNParentPath}/{name of repository}`.\n There's [more information in the official handbook about\n this](http://svnbook.red-bean.com/nightly/en/svn.serverconfig.httpd.html#svn.serverconfig.httpd.basic).\n\n### Configuring for use with Self-Signed Certificates\n\nAssuming that your Root CA is called **`root_ca.crt`**. Create and edit\n`/etc/sysconfig/servers` to add the following:\n\n [global] \n ssl-authority-files = /etc/pki/tls/certs/root_ca.crt\n\nThe other option is to use the system-wide keystore at\n`/etc/pki/tls/certs/ca-bundle.crt` by appending the ASCII version to the\nend of this file.\n\nResources\n---------\n\n* [mod\\_authnz\\_ldap directives - Apache page](http://httpd.apache.org/docs/2.1/mod/mod_authnz_ldap.html)\n* [Subversion on CentOS (Wiki)](http://wiki.centos.org/HowTos/Subversion)\n* [Single or multiple repositories?](http://stackoverflow.com/questions/252459/one-svn-repository-or-many/252717#252717)\n* [Version Control with Subversion](http://svnbook.red-bean.com/)\n* [SubVersion with Apache and LDAP integration](http://blogs.open.collab.net/svn/2009/03/subversion-with-apache-and-ldap-updated.html)\n* [Per-directory access control in SVN](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2)\n\n### Active Directory Integration\n\n* [Apache and Subversion authentication with Microsoft Active Directory](http://www.jejik.com/articles/2007/06/apache_and_subversion_authentication_with_microsoft_active_directory/)\n* [mod\\_auth\\_kerb and mod\\_authnz\\_ldap bring Apache web apps into the Enterprise](http://www.wadewoolwine.com/2009/01/28/mod_auth_kerb-and-mod_authnz_ldap-bring-apache-web-apps-into-the-enterprise/)\n* [Apache 2.2 – authnz\\_ldap – Active Directory](http://michele.pupazzo.org/diary/?p=227)\n" }, { "authorEmail": "mail@nikhil.io", "authorName": "Nikhil Anand", "date": "2025-06-06T14:38:23Z", "id": "c94a7e7ca1fce8cd9c634d81b8b5711166546c9c", "shortId": "c94a7e7c", "subject": "Merge branch 'master' of github.com:afreeorange/wiki.nikhil.io.articles\n", "content": "[TOC]\n\nHost is **svn.example.com**. There are basically two ways of serving up\na subversion repository. One uses `svnserve`, a lightweight server\n(default port 3690). The other is leveraging Apache (`httpd`) via the\nWebDAV protocol.\n\nThe latter is more complex. But it is extremely flexible in terms of\nadministration and is the basis for this setup guide. I will be setting\nup a single repository at `https://svn.example.com/repository` with SSL,\nLDAP-based authentication, and project-specific access control.\n\nInstallation\n------------\n\n### Getting the RPM\n\nI'm putting the SVN root in /home/svn as well. This can be anywhere.\n\n yum install subversion mod_dav_svn\n\nThis will install Apache and other dependencies as well.\n\n service httpd start \n chkconfig --level 345 httpd on\n\nMake sure it's working, and that `iptables` is not causing any issues.\nYou can use `nmap` for this purpose or just go to\n.\n\n### Preparing `subversion.conf`\n\nInstalling the packages will create a new apache configuration directive\nin `/etc/httpd/conf.d` called `subversion.conf`. You need to edit this\nfile to set up the location of the repository.\n\nFirst uncomment these files if they've not been uncommented:\n\n LoadModule dav_svn_module     modules/mod_dav_svn.so \n LoadModule authz_svn_module   modules/mod_authz_svn.so\n\nDefine the SVN root:\n\n \n         DAV svn \n         SVNPath /home/svn/repository \n \n\nNow you can add simple authentication or use LDAP.\n\nConfiguration\n-------------\n\n### Simple Authentication\n\nThis uses basic `htpasswd` based authentication. Passwords may be sent\nin the clear if you don't enable SSL. You can also use digest-based\nauthentication which is slightly more secure.\n\nFor this scheme, our `/etc/httpd/conf.d/subversion.conf` file will have\nthe following directive:\n\n \n         DAV svn \n         SVNPath /home/svn/repository \n          \n         # Simple authentication \n         AuthType Basic \n         AuthName \"SVN Server\" \n         AuthUserFile /home/svn/basic-authentication \n         Require valid-user \n \n\nHere, we use /home/svn/authorized-users to authenticate. Create this\nfile and add a user with:\n\n [root@svn ~]# htpasswd -cm /home/svn/authorized-users testuser \n New password:  \n Re-type new password:  \n Adding password for user testuser\n\n### Setting up the repository\n\n svnadmin create /home/svn/repository\n\nMake absolutely sure that Apache owns this directory and its\ndescendants!\n\n chown -R apache:apache /home/svn/repository\n\n### Testing the Configuration\n\nAt this point, you should have a repo accessible via Apache, with\npassword sent in clear text (we'll change that). I went to\n`http://svn.example.com` and saw the image to the right after entering\nmy credentials for testuser.\n\nExcellent! Test it now! I tested this config with Eclipse (with the\nSubclipse plugin.)\n\n### Securing with SSL\n\nTo secure stuff with SSL, generate or use a certificate and enable\nApache with `mod_ssl`. Change `subversion.conf` so that all traffic on\nport 80 is redirected to port 443 (which uses the certs we've created.)\n\n   \n          ServerName svn.example.com \n          RewriteEngine On \n          RewriteRule .* https://svn.example.com%{REQUEST_URI} [L,R=301] \n  \n\nRestart `httpd` and you're good to go!\n\n### LDAP integration\n\nIn this example, I will be using **directory.example.com** as the (Open\nDirectory-based) LDAP provider. Change the basic authentication scheme\nto match this:\n\n  # # If using some CA file \n  # LDAPTrustedMode NONE   \n  # LDAPTrustedGlobalCert CA_DER /etc/pki/tls/certs/root_ca.crt \n  # LDAPVerifyServerCert off\n\n  # Define the repository location \n   \n          DAV svn \n          SVNPath /home/svn/repository \n   \n          # Integrate with LDAP server \n          AuthType Basic \n          AuthBasicProvider ldap \n          AuthName \"SVN Server\" \n          AuthzLDAPAuthoritative off \n          AuthLDAPURL \"(ldap://directory.example.com/cn=users,dc=directory,dc=example,dc=com?uid?sub)?(objectClass=*)\" \n          Require valid-user \n          AuthzSVNAccessFile /home/svn/repository/conf/authz \n  \n\n**It is important** that you set `AuthBasicProvider ldap`. If not,\nApache will look for a password file and not even bother to authenticate\nagainst your LDAP server. You'll also see something like this when\nrestarting the `httpd` daemon:\n\n Invalid command 'AuthLDAPAuthoritative', perhaps misspelled or defined by a module not included in the server configuration\n\nI had terrible luck with setting `AuthzLDAPAuthoritative` to \"on\". You\ncan read the Apache `mod_authnz_ldap` page for more information on these\ndirectives. They're quite flexible when configuring multiple\nrepositories, with respect to user and group access.\n\nNow that you have a single repository, you can fine tune access with the\n`AuthzSVNAccessFile` directive. By default, and when you use\n`svnadmin create`, you get an `authz` file in your repository's `conf`\nfolder. In the Apache configuration above, it's the file I've used to\ntweak folder access.\n\nProject Management within a Repository\n--------------------------------------\n\n### Creating a project\n\nThis is very simple. It's vitally important that your project folder\ncontains three sub-folders: **trunk**, **branches** and **tags**. All\nthe code you want to check into the repository must be in **trunk**.\n\n#### Step 1: Create the required directory structure\n\n mkdir -p /tmp/newproject/{trunk,branches,tags}\n\n#### Step 2: Copy/move project files into `trunk`\n\n cp -R /path/to/project/files/* /tmp/newproject/trunk/\n\n#### Step 3: Perform the first commit\n\n cd /tmp\n svn import newproject https://svn.example.com/repository/myproject --message \"Initial import\" --username myuser\n\nObserve that my project is called `newproject` on my local machine but\nis `myproject` on the SVN server. You may or may not choose to do this,\nbut the option is available.\n\nYou may get a dialog about the certificate used to secure the\ntransaction. Accept the key permanently. You will then be required to\nsupply a password.\n\n#### Step 4: Working with your project\n\nMost typical CVS actions should apply (prefixed with an `svn` of\ncourse.) For example, to check out the project created above.\n\n svn checkout https://username@svn.example.com/repository/myproject\n\nThe Google teems with SVN cheatsheets.\n\n### Modifying Access Control\n\n**Important**: Only root can do this. Talk to your friendly sysadmin for\nproject-specific access control. By default, your newly created project\nwill be world accessible (i.e. to *all authenticated* users.)\n\nHere's an example where I created a folder for a rather sinister project\ncalled `thiswillendpoorly` and have given write access only to user\n`nanand` and read access to `machrist`. *The leading slash is\nimportant!*\n\n # Deny world access to repository root (noone needs to get a project listing) \n [/] \n * = \n \n # Allow only Nikhil and Mark to access this terrible project (Mark can only read) \n [/thiswillendpoorly] \n nanand = rw \n machrist = r \n * =\n\nIf you had multiple repositories, you would need to:\n\n* Change the Apache directive `SVNPath` to `SVNParentPath`\n* Specify the repository in the `authz` file\n\nHere's an example:\n\n [repository1:/path] \n user1 = rw \n user2 = r \n \n [repository2:/path] \n * = rw\n\nIf you specified a path without specifying the repository, the filter is\napplied across *all* repositories! This [is explained\nhere](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2).\n\nMiscellaneous\n-------------\n\n### Special note about LDAP groups\n\nYou cannot do LDAP group-based authentication in SVN with the `authz`\nfile. However, I've seen [a python\nscript](http://www.thoughtspark.org/node/26) which can import LDAP\ngroups.\n\n### Few pointers on multiple repository configuration\n\n* If you plan on hosting multiple repositories, you need to change\n `SVNPath` to \"SVNParentPath\".\n* *Apache will NOT allow you to access the root defined as\n `SVNParentPath`!* You need to create repositories using\n `svnadmin create` and can then access them through\n `http://svn.example.com/{path in SVNParentPath}/{name of repository}`.\n There's [more information in the official handbook about\n this](http://svnbook.red-bean.com/nightly/en/svn.serverconfig.httpd.html#svn.serverconfig.httpd.basic).\n\n### Configuring for use with Self-Signed Certificates\n\nAssuming that your Root CA is called **`root_ca.crt`**. Create and edit\n`/etc/sysconfig/servers` to add the following:\n\n [global] \n ssl-authority-files = /etc/pki/tls/certs/root_ca.crt\n\nThe other option is to use the system-wide keystore at\n`/etc/pki/tls/certs/ca-bundle.crt` by appending the ASCII version to the\nend of this file.\n\nResources\n---------\n\n* [mod\\_authnz\\_ldap directives - Apache page](http://httpd.apache.org/docs/2.1/mod/mod_authnz_ldap.html)\n* [Subversion on CentOS (Wiki)](http://wiki.centos.org/HowTos/Subversion)\n* [Single or multiple repositories?](http://stackoverflow.com/questions/252459/one-svn-repository-or-many/252717#252717)\n* [Version Control with Subversion](http://svnbook.red-bean.com/)\n* [SubVersion with Apache and LDAP integration](http://blogs.open.collab.net/svn/2009/03/subversion-with-apache-and-ldap-updated.html)\n* [Per-directory access control in SVN](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2)\n\n### Active Directory Integration\n\n* [Apache and Subversion authentication with Microsoft Active Directory](http://www.jejik.com/articles/2007/06/apache_and_subversion_authentication_with_microsoft_active_directory/)\n* [mod\\_auth\\_kerb and mod\\_authnz\\_ldap bring Apache web apps into the Enterprise](http://www.wadewoolwine.com/2009/01/28/mod_auth_kerb-and-mod_authnz_ldap-bring-apache-web-apps-into-the-enterprise/)\n* [Apache 2.2 – authnz\\_ldap – Active Directory](http://michele.pupazzo.org/diary/?p=227)\n" }, { "authorEmail": "mail@nikhil.io", "authorName": "Nikhil Anand", "date": "2021-06-04T03:04:37Z", "id": "fa9f7632d7901e6f9bb62b88594735ccc3588d28", "shortId": "fa9f7632", "subject": "Update Dovecot.md\n", "content": "[TOC]\n\nHost is **svn.example.com**. There are basically two ways of serving up\na subversion repository. One uses `svnserve`, a lightweight server\n(default port 3690). The other is leveraging Apache (`httpd`) via the\nWebDAV protocol.\n\nThe latter is more complex. But it is extremely flexible in terms of\nadministration and is the basis for this setup guide. I will be setting\nup a single repository at `https://svn.example.com/repository` with SSL,\nLDAP-based authentication, and project-specific access control.\n\nInstallation\n------------\n\n### Getting the RPM\n\nI'm putting the SVN root in /home/svn as well. This can be anywhere.\n\n yum install subversion mod_dav_svn\n\nThis will install Apache and other dependencies as well.\n\n service httpd start \n chkconfig --level 345 httpd on\n\nMake sure it's working, and that `iptables` is not causing any issues.\nYou can use `nmap` for this purpose or just go to\n.\n\n### Preparing `subversion.conf`\n\nInstalling the packages will create a new apache configuration directive\nin `/etc/httpd/conf.d` called `subversion.conf`. You need to edit this\nfile to set up the location of the repository.\n\nFirst uncomment these files if they've not been uncommented:\n\n LoadModule dav_svn_module     modules/mod_dav_svn.so \n LoadModule authz_svn_module   modules/mod_authz_svn.so\n\nDefine the SVN root:\n\n \n         DAV svn \n         SVNPath /home/svn/repository \n \n\nNow you can add simple authentication or use LDAP.\n\nConfiguration\n-------------\n\n### Simple Authentication\n\nThis uses basic `htpasswd` based authentication. Passwords may be sent\nin the clear if you don't enable SSL. You can also use digest-based\nauthentication which is slightly more secure.\n\nFor this scheme, our `/etc/httpd/conf.d/subversion.conf` file will have\nthe following directive:\n\n \n         DAV svn \n         SVNPath /home/svn/repository \n          \n         # Simple authentication \n         AuthType Basic \n         AuthName \"SVN Server\" \n         AuthUserFile /home/svn/basic-authentication \n         Require valid-user \n \n\nHere, we use /home/svn/authorized-users to authenticate. Create this\nfile and add a user with:\n\n [root@svn ~]# htpasswd -cm /home/svn/authorized-users testuser \n New password:  \n Re-type new password:  \n Adding password for user testuser\n\n### Setting up the repository\n\n svnadmin create /home/svn/repository\n\nMake absolutely sure that Apache owns this directory and its\ndescendants!\n\n chown -R apache:apache /home/svn/repository\n\n### Testing the Configuration\n\nAt this point, you should have a repo accessible via Apache, with\npassword sent in clear text (we'll change that). I went to\n`http://svn.example.com` and saw the image to the right after entering\nmy credentials for testuser.\n\nExcellent! Test it now! I tested this config with Eclipse (with the\nSubclipse plugin.)\n\n### Securing with SSL\n\nTo secure stuff with SSL, generate or use a certificate and enable\nApache with `mod_ssl`. Change `subversion.conf` so that all traffic on\nport 80 is redirected to port 443 (which uses the certs we've created.)\n\n   \n          ServerName svn.example.com \n          RewriteEngine On \n          RewriteRule .* https://svn.example.com%{REQUEST_URI} [L,R=301] \n  \n\nRestart `httpd` and you're good to go!\n\n### LDAP integration\n\nIn this example, I will be using **directory.example.com** as the (Open\nDirectory-based) LDAP provider. Change the basic authentication scheme\nto match this:\n\n  # # If using some CA file \n  # LDAPTrustedMode NONE   \n  # LDAPTrustedGlobalCert CA_DER /etc/pki/tls/certs/root_ca.crt \n  # LDAPVerifyServerCert off\n\n  # Define the repository location \n   \n          DAV svn \n          SVNPath /home/svn/repository \n   \n          # Integrate with LDAP server \n          AuthType Basic \n          AuthBasicProvider ldap \n          AuthName \"SVN Server\" \n          AuthzLDAPAuthoritative off \n          AuthLDAPURL \"(ldap://directory.example.com/cn=users,dc=directory,dc=example,dc=com?uid?sub)?(objectClass=*)\" \n          Require valid-user \n          AuthzSVNAccessFile /home/svn/repository/conf/authz \n  \n\n**It is important** that you set `AuthBasicProvider ldap`. If not,\nApache will look for a password file and not even bother to authenticate\nagainst your LDAP server. You'll also see something like this when\nrestarting the `httpd` daemon:\n\n Invalid command 'AuthLDAPAuthoritative', perhaps misspelled or defined by a module not included in the server configuration\n\nI had terrible luck with setting `AuthzLDAPAuthoritative` to \"on\". You\ncan read the Apache `mod_authnz_ldap` page for more information on these\ndirectives. They're quite flexible when configuring multiple\nrepositories, with respect to user and group access.\n\nNow that you have a single repository, you can fine tune access with the\n`AuthzSVNAccessFile` directive. By default, and when you use\n`svnadmin create`, you get an `authz` file in your repository's `conf`\nfolder. In the Apache configuration above, it's the file I've used to\ntweak folder access.\n\nProject Management within a Repository\n--------------------------------------\n\n### Creating a project\n\nThis is very simple. It's vitally important that your project folder\ncontains three sub-folders: **trunk**, **branches** and **tags**. All\nthe code you want to check into the repository must be in **trunk**.\n\n#### Step 1: Create the required directory structure\n\n mkdir -p /tmp/newproject/{trunk,branches,tags}\n\n#### Step 2: Copy/move project files into `trunk`\n\n cp -R /path/to/project/files/* /tmp/newproject/trunk/\n\n#### Step 3: Perform the first commit\n\n cd /tmp\n svn import newproject https://svn.example.com/repository/myproject --message \"Initial import\" --username myuser\n\nObserve that my project is called `newproject` on my local machine but\nis `myproject` on the SVN server. You may or may not choose to do this,\nbut the option is available.\n\nYou may get a dialog about the certificate used to secure the\ntransaction. Accept the key permanently. You will then be required to\nsupply a password.\n\n#### Step 4: Working with your project\n\nMost typical CVS actions should apply (prefixed with an `svn` of\ncourse.) For example, to check out the project created above.\n\n svn checkout https://username@svn.example.com/repository/myproject\n\nThe Google teems with SVN cheatsheets.\n\n### Modifying Access Control\n\n**Important**: Only root can do this. Talk to your friendly sysadmin for\nproject-specific access control. By default, your newly created project\nwill be world accessible (i.e. to *all authenticated* users.)\n\nHere's an example where I created a folder for a rather sinister project\ncalled `thiswillendpoorly` and have given write access only to user\n`nanand` and read access to `machrist`. *The leading slash is\nimportant!*\n\n # Deny world access to repository root (noone needs to get a project listing) \n [/] \n * = \n \n # Allow only Nikhil and Mark to access this terrible project (Mark can only read) \n [/thiswillendpoorly] \n nanand = rw \n machrist = r \n * =\n\nIf you had multiple repositories, you would need to:\n\n* Change the Apache directive `SVNPath` to `SVNParentPath`\n* Specify the repository in the `authz` file\n\nHere's an example:\n\n [repository1:/path] \n user1 = rw \n user2 = r \n \n [repository2:/path] \n * = rw\n\nIf you specified a path without specifying the repository, the filter is\napplied across *all* repositories! This [is explained\nhere](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2).\n\nMiscellaneous\n-------------\n\n### Special note about LDAP groups\n\nYou cannot do LDAP group-based authentication in SVN with the `authz`\nfile. However, I've seen [a python\nscript](http://www.thoughtspark.org/node/26) which can import LDAP\ngroups.\n\n### Few pointers on multiple repository configuration\n\n* If you plan on hosting multiple repositories, you need to change\n `SVNPath` to \"SVNParentPath\".\n* *Apache will NOT allow you to access the root defined as\n `SVNParentPath`!* You need to create repositories using\n `svnadmin create` and can then access them through\n `http://svn.example.com/{path in SVNParentPath}/{name of repository}`.\n There's [more information in the official handbook about\n this](http://svnbook.red-bean.com/nightly/en/svn.serverconfig.httpd.html#svn.serverconfig.httpd.basic).\n\n### Configuring for use with Self-Signed Certificates\n\nAssuming that your Root CA is called **`root_ca.crt`**. Create and edit\n`/etc/sysconfig/servers` to add the following:\n\n [global] \n ssl-authority-files = /etc/pki/tls/certs/root_ca.crt\n\nThe other option is to use the system-wide keystore at\n`/etc/pki/tls/certs/ca-bundle.crt` by appending the ASCII version to the\nend of this file.\n\nResources\n---------\n\n* [mod\\_authnz\\_ldap directives - Apache page](http://httpd.apache.org/docs/2.1/mod/mod_authnz_ldap.html)\n* [Subversion on CentOS (Wiki)](http://wiki.centos.org/HowTos/Subversion)\n* [Single or multiple repositories?](http://stackoverflow.com/questions/252459/one-svn-repository-or-many/252717#252717)\n* [Version Control with Subversion](http://svnbook.red-bean.com/)\n* [SubVersion with Apache and LDAP integration](http://blogs.open.collab.net/svn/2009/03/subversion-with-apache-and-ldap-updated.html)\n* [Per-directory access control in SVN](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2)\n\n### Active Directory Integration\n\n* [Apache and Subversion authentication with Microsoft Active Directory](http://www.jejik.com/articles/2007/06/apache_and_subversion_authentication_with_microsoft_active_directory/)\n* [mod\\_auth\\_kerb and mod\\_authnz\\_ldap bring Apache web apps into the Enterprise](http://www.wadewoolwine.com/2009/01/28/mod_auth_kerb-and-mod_authnz_ldap-bring-apache-web-apps-into-the-enterprise/)\n* [Apache 2.2 – authnz\\_ldap – Active Directory](http://michele.pupazzo.org/diary/?p=227)\n" }, { "authorEmail": "mail@nikhil.io", "authorName": "Nikhil Anand", "date": "2015-12-27T07:27:56Z", "id": "1aa29105a45aa67523ffb61e73bcc415f935a47e", "shortId": "1aa29105", "subject": "Fix Markdown conversion\n\nSaw half a season of The Office\n", "content": "[TOC]\n\nHost is **svn.example.com**. There are basically two ways of serving up\na subversion repository. One uses `svnserve`, a lightweight server\n(default port 3690). The other is leveraging Apache (`httpd`) via the\nWebDAV protocol.\n\nThe latter is more complex. But it is extremely flexible in terms of\nadministration and is the basis for this setup guide. I will be setting\nup a single repository at `https://svn.example.com/repository` with SSL,\nLDAP-based authentication, and project-specific access control.\n\nInstallation\n------------\n\n### Getting the RPM\n\nI'm putting the SVN root in /home/svn as well. This can be anywhere.\n\n yum install subversion mod_dav_svn\n\nThis will install Apache and other dependencies as well.\n\n service httpd start \n chkconfig --level 345 httpd on\n\nMake sure it's working, and that `iptables` is not causing any issues.\nYou can use `nmap` for this purpose or just go to\n.\n\n### Preparing `subversion.conf`\n\nInstalling the packages will create a new apache configuration directive\nin `/etc/httpd/conf.d` called `subversion.conf`. You need to edit this\nfile to set up the location of the repository.\n\nFirst uncomment these files if they've not been uncommented:\n\n LoadModule dav_svn_module     modules/mod_dav_svn.so \n LoadModule authz_svn_module   modules/mod_authz_svn.so\n\nDefine the SVN root:\n\n \n         DAV svn \n         SVNPath /home/svn/repository \n \n\nNow you can add simple authentication or use LDAP.\n\nConfiguration\n-------------\n\n### Simple Authentication\n\nThis uses basic `htpasswd` based authentication. Passwords may be sent\nin the clear if you don't enable SSL. You can also use digest-based\nauthentication which is slightly more secure.\n\nFor this scheme, our `/etc/httpd/conf.d/subversion.conf` file will have\nthe following directive:\n\n \n         DAV svn \n         SVNPath /home/svn/repository \n          \n         # Simple authentication \n         AuthType Basic \n         AuthName \"SVN Server\" \n         AuthUserFile /home/svn/basic-authentication \n         Require valid-user \n \n\nHere, we use /home/svn/authorized-users to authenticate. Create this\nfile and add a user with:\n\n [root@svn ~]# htpasswd -cm /home/svn/authorized-users testuser \n New password:  \n Re-type new password:  \n Adding password for user testuser\n\n### Setting up the repository\n\n svnadmin create /home/svn/repository\n\nMake absolutely sure that Apache owns this directory and its\ndescendants!\n\n chown -R apache:apache /home/svn/repository\n\n### Testing the Configuration\n\nAt this point, you should have a repo accessible via Apache, with\npassword sent in clear text (we'll change that). I went to\n`http://svn.example.com` and saw the image to the right after entering\nmy credentials for testuser.\n\nExcellent! Test it now! I tested this config with Eclipse (with the\nSubclipse plugin.)\n\n### Securing with SSL\n\nTo secure stuff with SSL, generate or use a certificate and enable\nApache with `mod_ssl`. Change `subversion.conf` so that all traffic on\nport 80 is redirected to port 443 (which uses the certs we've created.)\n\n   \n          ServerName svn.example.com \n          RewriteEngine On \n          RewriteRule .* https://svn.example.com%{REQUEST_URI} [L,R=301] \n  \n\nRestart `httpd` and you're good to go!\n\n### LDAP integration\n\nIn this example, I will be using **directory.example.com** as the (Open\nDirectory-based) LDAP provider. Change the basic authentication scheme\nto match this:\n\n  # # If using some CA file \n  # LDAPTrustedMode NONE   \n  # LDAPTrustedGlobalCert CA_DER /etc/pki/tls/certs/root_ca.crt \n  # LDAPVerifyServerCert off\n\n  # Define the repository location \n   \n          DAV svn \n          SVNPath /home/svn/repository \n   \n          # Integrate with LDAP server \n          AuthType Basic \n          AuthBasicProvider ldap \n          AuthName \"SVN Server\" \n          AuthzLDAPAuthoritative off \n          AuthLDAPURL \"(ldap://directory.example.com/cn=users,dc=directory,dc=example,dc=com?uid?sub)?(objectClass=*)\" \n          Require valid-user \n          AuthzSVNAccessFile /home/svn/repository/conf/authz \n  \n\n**It is important** that you set `AuthBasicProvider ldap`. If not,\nApache will look for a password file and not even bother to authenticate\nagainst your LDAP server. You'll also see something like this when\nrestarting the `httpd` daemon:\n\n Invalid command 'AuthLDAPAuthoritative', perhaps misspelled or defined by a module not included in the server configuration\n\nI had terrible luck with setting `AuthzLDAPAuthoritative` to \"on\". You\ncan read the Apache `mod_authnz_ldap` page for more information on these\ndirectives. They're quite flexible when configuring multiple\nrepositories, with respect to user and group access.\n\nNow that you have a single repository, you can fine tune access with the\n`AuthzSVNAccessFile` directive. By default, and when you use\n`svnadmin create`, you get an `authz` file in your repository's `conf`\nfolder. In the Apache configuration above, it's the file I've used to\ntweak folder access.\n\nProject Management within a Repository\n--------------------------------------\n\n### Creating a project\n\nThis is very simple. It's vitally important that your project folder\ncontains three sub-folders: **trunk**, **branches** and **tags**. All\nthe code you want to check into the repository must be in **trunk**.\n\n#### Step 1: Create the required directory structure\n\n mkdir -p /tmp/newproject/{trunk,branches,tags}\n\n#### Step 2: Copy/move project files into `trunk`\n\n cp -R /path/to/project/files/* /tmp/newproject/trunk/\n\n#### Step 3: Perform the first commit\n\n cd /tmp\n svn import newproject https://svn.example.com/repository/myproject --message \"Initial import\" --username myuser\n\nObserve that my project is called `newproject` on my local machine but\nis `myproject` on the SVN server. You may or may not choose to do this,\nbut the option is available.\n\nYou may get a dialog about the certificate used to secure the\ntransaction. Accept the key permanently. You will then be required to\nsupply a password.\n\n#### Step 4: Working with your project\n\nMost typical CVS actions should apply (prefixed with an `svn` of\ncourse.) For example, to check out the project created above.\n\n svn checkout https://username@svn.example.com/repository/myproject\n\nThe Google teems with SVN cheatsheets.\n\n### Modifying Access Control\n\n**Important**: Only root can do this. Talk to your friendly sysadmin for\nproject-specific access control. By default, your newly created project\nwill be world accessible (i.e. to *all authenticated* users.)\n\nHere's an example where I created a folder for a rather sinister project\ncalled `thiswillendpoorly` and have given write access only to user\n`nanand` and read access to `machrist`. *The leading slash is\nimportant!*\n\n # Deny world access to repository root (noone needs to get a project listing) \n [/] \n * = \n \n # Allow only Nikhil and Mark to access this terrible project (Mark can only read) \n [/thiswillendpoorly] \n nanand = rw \n machrist = r \n * =\n\nIf you had multiple repositories, you would need to:\n\n* Change the Apache directive `SVNPath` to `SVNParentPath`\n* Specify the repository in the `authz` file\n\nHere's an example:\n\n [repository1:/path] \n user1 = rw \n user2 = r \n \n [repository2:/path] \n * = rw\n\nIf you specified a path without specifying the repository, the filter is\napplied across *all* repositories! This [is explained\nhere](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2).\n\nMiscellaneous\n-------------\n\n### Special note about LDAP groups\n\nYou cannot do LDAP group-based authentication in SVN with the `authz`\nfile. However, I've seen [a python\nscript](http://www.thoughtspark.org/node/26) which can import LDAP\ngroups.\n\n### Few pointers on multiple repository configuration\n\n* If you plan on hosting multiple repositories, you need to change\n `SVNPath` to \"SVNParentPath\".\n* *Apache will NOT allow you to access the root defined as\n `SVNParentPath`!* You need to create repositories using\n `svnadmin create` and can then access them through\n `http://svn.example.com/{path in SVNParentPath}/{name of repository}`.\n There's [more information in the official handbook about\n this](http://svnbook.red-bean.com/nightly/en/svn.serverconfig.httpd.html#svn.serverconfig.httpd.basic).\n\n### Configuring for use with Self-Signed Certificates\n\nAssuming that your Root CA is called **`root_ca.crt`**. Create and edit\n`/etc/sysconfig/servers` to add the following:\n\n [global] \n ssl-authority-files = /etc/pki/tls/certs/root_ca.crt\n\nThe other option is to use the system-wide keystore at\n`/etc/pki/tls/certs/ca-bundle.crt` by appending the ASCII version to the\nend of this file.\n\nResources\n---------\n\n* [mod\\_authnz\\_ldap directives - Apache page](http://httpd.apache.org/docs/2.1/mod/mod_authnz_ldap.html)\n* [Subversion on CentOS (Wiki)](http://wiki.centos.org/HowTos/Subversion)\n* [Single or multiple repositories?](http://stackoverflow.com/questions/252459/one-svn-repository-or-many/252717#252717)\n* [Version Control with Subversion](http://svnbook.red-bean.com/)\n* [SubVersion with Apache and LDAP integration](http://blogs.open.collab.net/svn/2009/03/subversion-with-apache-and-ldap-updated.html)\n* [Per-directory access control in SVN](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2)\n\n### Active Directory Integration\n\n* [Apache and Subversion authentication with Microsoft Active Directory](http://www.jejik.com/articles/2007/06/apache_and_subversion_authentication_with_microsoft_active_directory/)\n* [mod\\_auth\\_kerb and mod\\_authnz\\_ldap bring Apache web apps into the Enterprise](http://www.wadewoolwine.com/2009/01/28/mod_auth_kerb-and-mod_authnz_ldap-bring-apache-web-apps-into-the-enterprise/)\n* [Apache 2.2 – authnz\\_ldap – Active Directory](http://michele.pupazzo.org/diary/?p=227)\n" }, { "authorEmail": "mail@nikhil.io", "authorName": "Nikhil Anand", "date": "2015-12-21T02:30:47Z", "id": "d658e80d1ecb97b196531c7b15a0f9af709c05de", "shortId": "d658e80d", "subject": "Incremental\n", "content": "Host is **svn.example.com**. There are basically two ways of serving up\na subversion repository. One uses `svnserve`, a lightweight server\n(default port 3690). The other is leveraging Apache (`httpd`) via the\nWebDAV protocol.\n\nThe latter is more complex. But it is extremely flexible in terms of\nadministration and is the basis for this setup guide. I will be setting\nup a single repository at with SSL,\nLDAP-based authentication, and project-specific access control.\n\nInstallation\n------------\n\n### Getting the RPM\n\nI'm putting the SVN root in /home/svn as well. This can be anywhere.\n\n` yum install subversion mod_dav_svn`\n\nThis will install Apache and other dependencies as well.\n\n` service httpd start` \n` chkconfig --level 345 httpd on`\n\nMake sure it's working, and that `iptables` is not causing any issues.\nYou can use `nmap` for this purpose or just go to\n.\n\n### Preparing `subversion.conf`\n\nInstalling the packages will create a new apache configuration directive\nin `/etc/httpd/conf.d` called `subversion.conf`. You need to edit this\nfile to set up the location of the repository.\n\nFirst uncomment these files if they've not been uncommented:\n\n` LoadModule dav_svn_module     modules/mod_dav_svn.so` \n` LoadModule authz_svn_module   modules/mod_authz_svn.so`\n\nDefine the SVN root:\n\n` ` \n`         DAV svn` \n`         SVNPath /home/svn/repository` \n` `\n\nNow you can add simple authentication or use LDAP.\n\nConfiguration\n-------------\n\n### Simple Authentication\n\nThis uses basic `htpasswd` based authentication. Passwords may be sent\nin the clear if you don't enable SSL. You can also use digest-based\nauthentication which is slightly more secure.\n\nFor this scheme, our `/etc/httpd/conf.d/subversion.conf` file will have\nthe following directive:\n\n` ` \n`         DAV svn` \n`         SVNPath /home/svn/repository` \n`         ` \n`         # Simple authentication` \n`         AuthType Basic` \n`         AuthName \"SVN Server\"` \n`         AuthUserFile /home/svn/basic-authentication` \n`         Require valid-user` \n` `\n\nHere, we use /home/svn/authorized-users to authenticate. Create this\nfile and add a user with:\n\n`[root@svn ~]# htpasswd -cm /home/svn/authorized-users testuser` \n`New password: ` \n`Re-type new password: ` \n`Adding password for user testuser`\n\n### Setting up the repository\n\n` svnadmin create /home/svn/repository`\n\nMake absolutely sure that Apache owns this directory and its\ndescendants!\n\n` chown -R apache:apache /home/svn/repository`\n\n### Testing the Configuration\n\nAt this point, you should have a repo accessible via Apache, with\npassword sent in clear text (we'll change that). I went to\n and saw the image to the right after entering\nmy credentials for testuser.\n\nExcellent! Test it now! I tested this config with Eclipse (with the\nSubclipse plugin.)\n\n### Securing with SSL\n\nTo secure stuff with SSL, generate or use a certificate and enable\nApache with `mod_ssl`. Change `subversion.conf` so that all traffic on\nport 80 is redirected to port 443 (which uses the certs we've created.)\n\n` ` \n`         ServerName svn.example.com` \n`         RewriteEngine On` \n`         RewriteRule .* `[`https://svn.example.com%{REQUEST_URI}`](https://svn.example.com%%7BREQUEST_URI%7D)` [L,R=301]` \n` `\n\nRestart `httpd` and you're good to go!\n\n### LDAP integration\n\nIn this example, I will be using **directory.example.com** as the (Open\nDirectory-based) LDAP provider. Change the basic authentication scheme\nto match this:\n\n` # # If using some CA file` \n` # LDAPTrustedMode NONE  ` \n` # LDAPTrustedGlobalCert CA_DER /etc/pki/tls/certs/root_ca.crt` \n` # LDAPVerifyServerCert off`\n\n` # Define the repository location` \n` ` \n`         DAV svn` \n`         SVNPath /home/svn/repository` \n` ` \n`         # Integrate with LDAP server` \n`         AuthType Basic` \n`         AuthBasicProvider ldap` \n`         AuthName \"SVN Server\"` \n`         AuthzLDAPAuthoritative off` \n`         AuthLDAPURL \"`[`ldap://directory.example.com/cn=users,dc=directory,dc=example,dc=com?uid?sub`](ldap://directory.example.com/cn=users,dc=directory,dc=example,dc=com?uid?sub)`?(objectClass=*)\"` \n`         Require valid-user` \n`         AuthzSVNAccessFile /home/svn/repository/conf/authz` \n` `\n\n**It is important** that you set `AuthBasicProvider ldap`. If not,\nApache will look for a password file and not even bother to authenticate\nagainst your LDAP server. You'll also see something like this when\nrestarting the `httpd` daemon:\n\n` Invalid command 'AuthLDAPAuthoritative', perhaps misspelled or defined by a module not included in the server configuration`\n\nI had terrible luck with setting `AuthzLDAPAuthoritative` to \"on\". You\ncan read the Apache `mod_authnz_ldap` page for more information on these\ndirectives. They're quite flexible when configuring multiple\nrepositories, with respect to user and group access.\n\nNow that you have a single repository, you can fine tune access with the\n`AuthzSVNAccessFile` directive. By default, and when you use\n`svnadmin create`, you get an `authz` file in your repository's `conf`\nfolder. In the Apache configuration above, it's the file I've used to\ntweak folder access.\n\nProject Management within a Repository\n--------------------------------------\n\n### Creating a project\n\nThis is very simple. It's vitally important that your project folder\ncontains three sub-folders: **trunk**, **branches** and **tags**. All\nthe code you want to check into the repository must be in **trunk**.\n\n#### Step 1: Create the required directory structure\n\n`  mkdir -p /tmp/newproject/{trunk,branches,tags}`\n\n#### Step 2: Copy/move project files into `trunk`\n\n` cp -R /path/to/project/files/* /tmp/newproject/trunk/`\n\n#### Step 3: Perform the first commit\n\n` cd /tmp` \n` svn import newproject `[`https://svn.example.com/repository/myproject`](https://svn.example.com/repository/myproject)` --message \"Initial import\" --username myuser`\n\nObserve that my project is called `newproject` on my local machine but\nis `myproject` on the SVN server. You may or may not choose to do this,\nbut the option is available.\n\nYou may get a dialog about the certificate used to secure the\ntransaction. Accept the key permanently. You will then be required to\nsupply a password.\n\n#### Step 4: Working with your project\n\nMost typical CVS actions should apply (prefixed with an `svn` of\ncourse.) For example, to check out the project created above.\n\n` svn checkout `[`https://username@svn.example.com/repository/myproject`](https://username@svn.example.com/repository/myproject)\n\nThe Google teems with SVN cheatsheets.\n\n### Modifying Access Control\n\n**Important**: Only root can do this. Talk to your friendly sysadmin for\nproject-specific access control. By default, your newly created project\nwill be world accessible (i.e. to *all authenticated* users.)\n\nHere's an example where I created a folder for a rather sinister project\ncalled `thiswillendpoorly` and have given write access only to user\n`nanand` and read access to `machrist`. *The leading slash is\nimportant!*\n\n` # Deny world access to repository root (noone needs to get a project listing)` \n` [/]` \n` * =` \n` ` \n` # Allow only Nikhil and Mark to access this terrible project (Mark can only read)` \n` [/thiswillendpoorly]` \n` nanand = rw` \n` machrist = r` \n` * =`\n\nIf you had multiple repositories, you would need to:\n\n- Change the Apache directive `SVNPath` to `SVNParentPath`\n- Specify the repository in the `authz` file\n\nHere's an example:\n\n` [repository1:/path]` \n` user1 = rw` \n` user2 = r` \n` ` \n` [repository2:/path]` \n` * = rw`\n\nIf you specified a path without specifying the repository, the filter is\napplied across *all* repositories! This [is explained\nhere](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2).\n\nMiscellaneous\n-------------\n\n### Special note about LDAP groups\n\nYou cannot do LDAP group-based authentication in SVN with the `authz`\nfile. However, I've seen [a python\nscript](http://www.thoughtspark.org/node/26) which can import LDAP\ngroups.\n\n### Few pointers on multiple repository configuration\n\n- If you plan on hosting multiple repositories, you need to change\n `SVNPath` to \"SVNParentPath\".\n- *Apache will NOT allow you to access the root defined as\n `SVNParentPath`!* You need to create repositories using\n `svnadmin create` and can then access them through\n `http://svn.example.com/{path in SVNParentPath}/{name of repository}`.\n There's [more information in the official handbook about\n this](http://svnbook.red-bean.com/nightly/en/svn.serverconfig.httpd.html#svn.serverconfig.httpd.basic).\n\n### Configuring for use with Self-Signed Certificates\n\nAssuming that your Root CA is called **`root_ca.crt`**. Create and edit\n`/etc/sysconfig/servers` to add the following:\n\n` [global]` \n` ssl-authority-files = /etc/pki/tls/certs/root_ca.crt`\n\nThe other option is to use the system-wide keystore at\n`/etc/pki/tls/certs/ca-bundle.crt` by appending the ASCII version to the\nend of this file.\n\nResources\n---------\n\n- [mod\\_authnz\\_ldap directives - Apache\n page](http://httpd.apache.org/docs/2.1/mod/mod_authnz_ldap.html)\n- [Subversion on\n CentOS (Wiki)](http://wiki.centos.org/HowTos/Subversion)\n- [Single or multiple\n repositories?](http://stackoverflow.com/questions/252459/one-svn-repository-or-many/252717#252717)\n- [Version Control with Subversion](http://svnbook.red-bean.com/)\n- [SubVersion with Apache and LDAP\n integration](http://blogs.open.collab.net/svn/2009/03/subversion-with-apache-and-ldap-updated.html)\n- [Per-directory access control in\n SVN](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2)\n\n### Active Directory Integration\n\n- [Apache and Subversion authentication with Microsoft Active\n Directory](http://www.jejik.com/articles/2007/06/apache_and_subversion_authentication_with_microsoft_active_directory/)\n- [mod\\_auth\\_kerb and mod\\_authnz\\_ldap bring Apache web apps into\n the\n Enterprise](http://www.wadewoolwine.com/2009/01/28/mod_auth_kerb-and-mod_authnz_ldap-bring-apache-web-apps-into-the-enterprise/)\n- [Apache 2.2 – authnz\\_ldap – Active\n Directory](http://michele.pupazzo.org/diary/?p=227)\n" }, { "authorEmail": "mail@nikhil.io", "authorName": "Nikhil Anand", "date": "2015-12-20T19:56:53Z", "id": "3c3214678f7c710096c7f134e724e5b6d51a12bb", "shortId": "3c321467", "subject": "Subversion Installation and Configuration : First Draft\n", "content": "Host is **svn.example.com**. There are basically two ways of serving up\na subversion repository. One uses `svnserve`, a lightweight server\n(default port 3690). The other is leveraging Apache (`httpd`) via the\nWebDAV protocol.\n\nThe latter is more complex. But it is extremely flexible in terms of\nadministration and is the basis for this setup guide. I will be setting\nup a single repository at with SSL,\nLDAP-based authentication, and project-specific access control.\n\nInstallation\n------------\n\n### Getting the RPM\n\nI'm putting the SVN root in /home/svn as well. This can be anywhere.\n\n` yum install subversion mod_dav_svn`\n\nThis will install Apache and other dependencies as well.\n\n` service httpd start` \n` chkconfig --level 345 httpd on`\n\nMake sure it's working, and that `iptables` is not causing any issues.\nYou can use `nmap` for this purpose or just go to\n.\n\n### Preparing `subversion.conf`\n\nInstalling the packages will create a new apache configuration directive\nin `/etc/httpd/conf.d` called `subversion.conf`. You need to edit this\nfile to set up the location of the repository.\n\nFirst uncomment these files if they've not been uncommented:\n\n` LoadModule dav_svn_module     modules/mod_dav_svn.so` \n` LoadModule authz_svn_module   modules/mod_authz_svn.so`\n\nDefine the SVN root:\n\n` ` \n`         DAV svn` \n`         SVNPath /home/svn/repository` \n` `\n\nNow you can add simple authentication or use LDAP.\n\nConfiguration\n-------------\n\n### Simple Authentication\n\nThis uses basic `htpasswd` based authentication. Passwords may be sent\nin the clear if you don't enable SSL. You can also use digest-based\nauthentication which is slightly more secure.\n\nFor this scheme, our `/etc/httpd/conf.d/subversion.conf` file will have\nthe following directive:\n\n` ` \n`         DAV svn` \n`         SVNPath /home/svn/repository` \n`         ` \n`         # Simple authentication` \n`         AuthType Basic` \n`         AuthName \"SVN Server\"` \n`         AuthUserFile /home/svn/basic-authentication` \n`         Require valid-user` \n` `\n\nHere, we use /home/svn/authorized-users to authenticate. Create this\nfile and add a user with:\n\n`[root@svn ~]# htpasswd -cm /home/svn/authorized-users testuser` \n`New password: ` \n`Re-type new password: ` \n`Adding password for user testuser`\n\n### Setting up the repository\n\n` svnadmin create /home/svn/repository`\n\nMake absolutely sure that Apache owns this directory and its\ndescendants!\n\n` chown -R apache:apache /home/svn/repository`\n\n### Testing the Configuration\n\nAt this point, you should have a repo accessible via Apache, with\npassword sent in clear text (we'll change that). I went to\n and saw the image to the right after entering\nmy credentials for testuser.\n\nExcellent! Test it now! I tested this config with Eclipse (with the\nSubclipse plugin.)\n\n### Securing with SSL\n\nTo secure stuff with SSL, generate or use a certificate and enable\nApache with `mod_ssl`. Change `subversion.conf` so that all traffic on\nport 80 is redirected to port 443 (which uses the certs we've created.)\n\n` ` \n`         ServerName svn.example.com` \n`         RewriteEngine On` \n`         RewriteRule .* `[`https://svn.example.com%{REQUEST_URI}`](https://svn.example.com%%7BREQUEST_URI%7D)` [L,R=301]` \n` `\n\nRestart `httpd` and you're good to go!\n\n### LDAP integration\n\nIn this example, I will be using **directory.example.com** as the (Open\nDirectory-based) LDAP provider. Change the basic authentication scheme\nto match this:\n\n` # # If using some CA file` \n` # LDAPTrustedMode NONE  ` \n` # LDAPTrustedGlobalCert CA_DER /etc/pki/tls/certs/root_ca.crt` \n` # LDAPVerifyServerCert off`\n\n` # Define the repository location` \n` ` \n`         DAV svn` \n`         SVNPath /home/svn/repository` \n` ` \n`         # Integrate with LDAP server` \n`         AuthType Basic` \n`         AuthBasicProvider ldap` \n`         AuthName \"SVN Server\"` \n`         AuthzLDAPAuthoritative off` \n`         AuthLDAPURL \"`[`ldap://directory.example.com/cn=users,dc=directory,dc=example,dc=com?uid?sub`](ldap://directory.example.com/cn=users,dc=directory,dc=example,dc=com?uid?sub)`?(objectClass=*)\"` \n`         Require valid-user` \n`         AuthzSVNAccessFile /home/svn/repository/conf/authz` \n` `\n\n**It is important** that you set `AuthBasicProvider ldap`. If not,\nApache will look for a password file and not even bother to authenticate\nagainst your LDAP server. You'll also see something like this when\nrestarting the `httpd` daemon:\n\n` Invalid command 'AuthLDAPAuthoritative', perhaps misspelled or defined by a module not included in the server configuration`\n\nI had terrible luck with setting `AuthzLDAPAuthoritative` to \"on\". You\ncan read the Apache `mod_authnz_ldap` page for more information on these\ndirectives. They're quite flexible when configuring multiple\nrepositories, with respect to user and group access.\n\nNow that you have a single repository, you can fine tune access with the\n`AuthzSVNAccessFile` directive. By default, and when you use\n`svnadmin create`, you get an `authz` file in your repository's `conf`\nfolder. In the Apache configuration above, it's the file I've used to\ntweak folder access.\n\nProject Management within a Repository\n--------------------------------------\n\n### Creating a project\n\nThis is very simple. It's vitally important that your project folder\ncontains three sub-folders: **trunk**, **branches** and **tags**. All\nthe code you want to check into the repository must be in **trunk**.\n\n#### Step 1: Create the required directory structure\n\n`  mkdir -p /tmp/newproject/{trunk,branches,tags}`\n\n#### Step 2: Copy/move project files into `trunk`\n\n` cp -R /path/to/project/files/* /tmp/newproject/trunk/`\n\n#### Step 3: Perform the first commit\n\n` cd /tmp` \n` svn import newproject `[`https://svn.example.com/repository/myproject`](https://svn.example.com/repository/myproject)` --message \"Initial import\" --username myuser`\n\nObserve that my project is called `newproject` on my local machine but\nis `myproject` on the SVN server. You may or may not choose to do this,\nbut the option is available.\n\nYou may get a dialog about the certificate used to secure the\ntransaction. Accept the key permanently. You will then be required to\nsupply a password.\n\n#### Step 4: Working with your project\n\nMost typical CVS actions should apply (prefixed with an `svn` of\ncourse.) For example, to check out the project created above.\n\n` svn checkout `[`https://username@svn.example.com/repository/myproject`](https://username@svn.example.com/repository/myproject)\n\nThe Google teems with SVN cheatsheets.\n\n### Modifying Access Control\n\n**Important**: Only root can do this. Talk to your friendly sysadmin for\nproject-specific access control. By default, your newly created project\nwill be world accessible (i.e. to *all authenticated* users.)\n\nHere's an example where I created a folder for a rather sinister project\ncalled `thiswillendpoorly` and have given write access only to user\n`nanand` and read access to `machrist`. *The leading slash is\nimportant!*\n\n` # Deny world access to repository root (noone needs to get a project listing)` \n` [/]` \n` * =` \n` ` \n` # Allow only Nikhil and Mark to access this terrible project (Mark can only read)` \n` [/thiswillendpoorly]` \n` nanand = rw` \n` machrist = r` \n` * =`\n\nIf you had multiple repositories, you would need to:\n\n- Change the Apache directive `SVNPath` to `SVNParentPath`\n- Specify the repository in the `authz` file\n\nHere's an example:\n\n` [repository1:/path]` \n` user1 = rw` \n` user2 = r` \n` ` \n` [repository2:/path]` \n` * = rw`\n\nIf you specified a path without specifying the repository, the filter is\napplied across *all* repositories! This [is explained\nhere](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2).\n\nMiscellaneous\n-------------\n\n### Special note about LDAP groups\n\nYou cannot do LDAP group-based authentication in SVN with the `authz`\nfile. However, I've seen [a python\nscript](http://www.thoughtspark.org/node/26) which can import LDAP\ngroups.\n\n### Few pointers on multiple repository configuration\n\n- If you plan on hosting multiple repositories, you need to change\n `SVNPath` to \"SVNParentPath\".\n- *Apache will NOT allow you to access the root defined as\n `SVNParentPath`!* You need to create repositories using\n `svnadmin create` and can then access them through\n `http://svn.example.com/{path in SVNParentPath}/{name of repository}`.\n There's [more information in the official handbook about\n this](http://svnbook.red-bean.com/nightly/en/svn.serverconfig.httpd.html#svn.serverconfig.httpd.basic).\n\n### Configuring for use with Self-Signed Certificates\n\nAssuming that your Root CA is called **`root_ca.crt`**. Create and edit\n`/etc/sysconfig/servers` to add the following:\n\n` [global]` \n` ssl-authority-files = /etc/pki/tls/certs/root_ca.crt`\n\nThe other option is to use the system-wide keystore at\n`/etc/pki/tls/certs/ca-bundle.crt` by appending the ASCII version to the\nend of this file.\n\nResources\n---------\n\n- [mod\\_authnz\\_ldap directives - Apache\n page](http://httpd.apache.org/docs/2.1/mod/mod_authnz_ldap.html)\n- [Subversion on\n CentOS (Wiki)](http://wiki.centos.org/HowTos/Subversion)\n- [Single or multiple\n repositories?](http://stackoverflow.com/questions/252459/one-svn-repository-or-many/252717#252717)\n- [Version Control with Subversion](http://svnbook.red-bean.com/)\n- [SubVersion with Apache and LDAP\n integration](http://blogs.open.collab.net/svn/2009/03/subversion-with-apache-and-ldap-updated.html)\n- [Per-directory access control in\n SVN](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2)\n\n### Active Directory Integration\n\n- [Apache and Subversion authentication with Microsoft Active\n Directory](http://www.jejik.com/articles/2007/06/apache_and_subversion_authentication_with_microsoft_active_directory/)\n- [mod\\_auth\\_kerb and mod\\_authnz\\_ldap bring Apache web apps into\n the\n Enterprise](http://www.wadewoolwine.com/2009/01/28/mod_auth_kerb-and-mod_authnz_ldap-bring-apache-web-apps-into-the-enterprise/)\n- [Apache 2.2 – authnz\\_ldap – Active\n Directory](http://michele.pupazzo.org/diary/?p=227)\n\n[Category:Nikhil's Notes](Category:Nikhil's_Notes \"wikilink\")\n[Category:From a past sysadmin\nlife](Category:From_a_past_sysadmin_life \"wikilink\")\n" } ], "sizeInBytes": 10580, "source": "[TOC]\n\nHost is **svn.example.com**. There are basically two ways of serving up\na subversion repository. One uses `svnserve`, a lightweight server\n(default port 3690). The other is leveraging Apache (`httpd`) via the\nWebDAV protocol.\n\nThe latter is more complex. But it is extremely flexible in terms of\nadministration and is the basis for this setup guide. I will be setting\nup a single repository at `https://svn.example.com/repository` with SSL,\nLDAP-based authentication, and project-specific access control.\n\nInstallation\n------------\n\n### Getting the RPM\n\nI'm putting the SVN root in /home/svn as well. This can be anywhere.\n\n yum install subversion mod_dav_svn\n\nThis will install Apache and other dependencies as well.\n\n service httpd start \n chkconfig --level 345 httpd on\n\nMake sure it's working, and that `iptables` is not causing any issues.\nYou can use `nmap` for this purpose or just go to\n.\n\n### Preparing `subversion.conf`\n\nInstalling the packages will create a new apache configuration directive\nin `/etc/httpd/conf.d` called `subversion.conf`. You need to edit this\nfile to set up the location of the repository.\n\nFirst uncomment these files if they've not been uncommented:\n\n LoadModule dav_svn_module     modules/mod_dav_svn.so \n LoadModule authz_svn_module   modules/mod_authz_svn.so\n\nDefine the SVN root:\n\n \n         DAV svn \n         SVNPath /home/svn/repository \n \n\nNow you can add simple authentication or use LDAP.\n\nConfiguration\n-------------\n\n### Simple Authentication\n\nThis uses basic `htpasswd` based authentication. Passwords may be sent\nin the clear if you don't enable SSL. You can also use digest-based\nauthentication which is slightly more secure.\n\nFor this scheme, our `/etc/httpd/conf.d/subversion.conf` file will have\nthe following directive:\n\n \n         DAV svn \n         SVNPath /home/svn/repository \n          \n         # Simple authentication \n         AuthType Basic \n         AuthName \"SVN Server\" \n         AuthUserFile /home/svn/basic-authentication \n         Require valid-user \n \n\nHere, we use /home/svn/authorized-users to authenticate. Create this\nfile and add a user with:\n\n [root@svn ~]# htpasswd -cm /home/svn/authorized-users testuser \n New password:  \n Re-type new password:  \n Adding password for user testuser\n\n### Setting up the repository\n\n svnadmin create /home/svn/repository\n\nMake absolutely sure that Apache owns this directory and its\ndescendants!\n\n chown -R apache:apache /home/svn/repository\n\n### Testing the Configuration\n\nAt this point, you should have a repo accessible via Apache, with\npassword sent in clear text (we'll change that). I went to\n`http://svn.example.com` and saw the image to the right after entering\nmy credentials for testuser.\n\nExcellent! Test it now! I tested this config with Eclipse (with the\nSubclipse plugin.)\n\n### Securing with SSL\n\nTo secure stuff with SSL, generate or use a certificate and enable\nApache with `mod_ssl`. Change `subversion.conf` so that all traffic on\nport 80 is redirected to port 443 (which uses the certs we've created.)\n\n   \n          ServerName svn.example.com \n          RewriteEngine On \n          RewriteRule .* https://svn.example.com%{REQUEST_URI} [L,R=301] \n  \n\nRestart `httpd` and you're good to go!\n\n### LDAP integration\n\nIn this example, I will be using **directory.example.com** as the (Open\nDirectory-based) LDAP provider. Change the basic authentication scheme\nto match this:\n\n  # # If using some CA file \n  # LDAPTrustedMode NONE   \n  # LDAPTrustedGlobalCert CA_DER /etc/pki/tls/certs/root_ca.crt \n  # LDAPVerifyServerCert off\n\n  # Define the repository location \n   \n          DAV svn \n          SVNPath /home/svn/repository \n   \n          # Integrate with LDAP server \n          AuthType Basic \n          AuthBasicProvider ldap \n          AuthName \"SVN Server\" \n          AuthzLDAPAuthoritative off \n          AuthLDAPURL \"(ldap://directory.example.com/cn=users,dc=directory,dc=example,dc=com?uid?sub)?(objectClass=*)\" \n          Require valid-user \n          AuthzSVNAccessFile /home/svn/repository/conf/authz \n  \n\n**It is important** that you set `AuthBasicProvider ldap`. If not,\nApache will look for a password file and not even bother to authenticate\nagainst your LDAP server. You'll also see something like this when\nrestarting the `httpd` daemon:\n\n Invalid command 'AuthLDAPAuthoritative', perhaps misspelled or defined by a module not included in the server configuration\n\nI had terrible luck with setting `AuthzLDAPAuthoritative` to \"on\". You\ncan read the Apache `mod_authnz_ldap` page for more information on these\ndirectives. They're quite flexible when configuring multiple\nrepositories, with respect to user and group access.\n\nNow that you have a single repository, you can fine tune access with the\n`AuthzSVNAccessFile` directive. By default, and when you use\n`svnadmin create`, you get an `authz` file in your repository's `conf`\nfolder. In the Apache configuration above, it's the file I've used to\ntweak folder access.\n\nProject Management within a Repository\n--------------------------------------\n\n### Creating a project\n\nThis is very simple. It's vitally important that your project folder\ncontains three sub-folders: **trunk**, **branches** and **tags**. All\nthe code you want to check into the repository must be in **trunk**.\n\n#### Step 1: Create the required directory structure\n\n mkdir -p /tmp/newproject/{trunk,branches,tags}\n\n#### Step 2: Copy/move project files into `trunk`\n\n cp -R /path/to/project/files/* /tmp/newproject/trunk/\n\n#### Step 3: Perform the first commit\n\n cd /tmp\n svn import newproject https://svn.example.com/repository/myproject --message \"Initial import\" --username myuser\n\nObserve that my project is called `newproject` on my local machine but\nis `myproject` on the SVN server. You may or may not choose to do this,\nbut the option is available.\n\nYou may get a dialog about the certificate used to secure the\ntransaction. Accept the key permanently. You will then be required to\nsupply a password.\n\n#### Step 4: Working with your project\n\nMost typical CVS actions should apply (prefixed with an `svn` of\ncourse.) For example, to check out the project created above.\n\n svn checkout https://username@svn.example.com/repository/myproject\n\nThe Google teems with SVN cheatsheets.\n\n### Modifying Access Control\n\n**Important**: Only root can do this. Talk to your friendly sysadmin for\nproject-specific access control. By default, your newly created project\nwill be world accessible (i.e. to *all authenticated* users.)\n\nHere's an example where I created a folder for a rather sinister project\ncalled `thiswillendpoorly` and have given write access only to user\n`nanand` and read access to `machrist`. *The leading slash is\nimportant!*\n\n # Deny world access to repository root (noone needs to get a project listing) \n [/] \n * = \n \n # Allow only Nikhil and Mark to access this terrible project (Mark can only read) \n [/thiswillendpoorly] \n nanand = rw \n machrist = r \n * =\n\nIf you had multiple repositories, you would need to:\n\n* Change the Apache directive `SVNPath` to `SVNParentPath`\n* Specify the repository in the `authz` file\n\nHere's an example:\n\n [repository1:/path] \n user1 = rw \n user2 = r \n \n [repository2:/path] \n * = rw\n\nIf you specified a path without specifying the repository, the filter is\napplied across *all* repositories! This [is explained\nhere](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2).\n\nMiscellaneous\n-------------\n\n### Special note about LDAP groups\n\nYou cannot do LDAP group-based authentication in SVN with the `authz`\nfile. However, I've seen [a python\nscript](http://www.thoughtspark.org/node/26) which can import LDAP\ngroups.\n\n### Few pointers on multiple repository configuration\n\n* If you plan on hosting multiple repositories, you need to change\n `SVNPath` to \"SVNParentPath\".\n* *Apache will NOT allow you to access the root defined as\n `SVNParentPath`!* You need to create repositories using\n `svnadmin create` and can then access them through\n `http://svn.example.com/{path in SVNParentPath}/{name of repository}`.\n There's [more information in the official handbook about\n this](http://svnbook.red-bean.com/nightly/en/svn.serverconfig.httpd.html#svn.serverconfig.httpd.basic).\n\n### Configuring for use with Self-Signed Certificates\n\nAssuming that your Root CA is called **`root_ca.crt`**. Create and edit\n`/etc/sysconfig/servers` to add the following:\n\n [global] \n ssl-authority-files = /etc/pki/tls/certs/root_ca.crt\n\nThe other option is to use the system-wide keystore at\n`/etc/pki/tls/certs/ca-bundle.crt` by appending the ASCII version to the\nend of this file.\n\nResources\n---------\n\n* [mod\\_authnz\\_ldap directives - Apache page](http://httpd.apache.org/docs/2.1/mod/mod_authnz_ldap.html)\n* [Subversion on CentOS (Wiki)](http://wiki.centos.org/HowTos/Subversion)\n* [Single or multiple repositories?](http://stackoverflow.com/questions/252459/one-svn-repository-or-many/252717#252717)\n* [Version Control with Subversion](http://svnbook.red-bean.com/)\n* [SubVersion with Apache and LDAP integration](http://blogs.open.collab.net/svn/2009/03/subversion-with-apache-and-ldap-updated.html)\n* [Per-directory access control in SVN](http://svnbook.red-bean.com/en/1.0/svn-book.html#svn-ch-6-sect-4.4.2)\n\n### Active Directory Integration\n\n* [Apache and Subversion authentication with Microsoft Active Directory](http://www.jejik.com/articles/2007/06/apache_and_subversion_authentication_with_microsoft_active_directory/)\n* [mod\\_auth\\_kerb and mod\\_authnz\\_ldap bring Apache web apps into the Enterprise](http://www.wadewoolwine.com/2009/01/28/mod_auth_kerb-and-mod_authnz_ldap-bring-apache-web-apps-into-the-enterprise/)\n* [Apache 2.2 – authnz\\_ldap – Active Directory](http://michele.pupazzo.org/diary/?p=227)\n", "title": "Subversion Installation and Configuration", "untracked": false, "uri": "/Subversion_Installation_and_Configuration", "relativePath": "Subversion Installation and Configuration.md" }