svn server with dav_svn and ssl on ubuntu

1. install subversion and enable dav_svn ssl

1.1. install subversion

apt-get install subversion subversion-tools apache2 libapache2-svn

1.2. Create subversion directory

mkdir -p /svn/repos

1.3. Create a test repository

svnadmin create /home/repos/sandbox

1.4. import project

mkdir ~/sandbox

mkdir -p ~/sandbox/trunk ~/sandbox/tags ~/sandbox/branches

svn import ~/sandbox file:///svn/repos/sandbox

1.5. enable apache2 access

chown -R www-data:www-data /svn

chmod -R g+ws /svn

1.6. enable dav_svn on apache2

a2enmod dav_svn

1.7. enable ssl on apache2

a2enmod ssl

cd sites-available

a2ensite default-ssl

(a2dismod ssl)

(a2dissite default-ssl)

(service apache2 restart)

2.1 configurate dav_svn

2.1. modifty /etc/apache2/mods_enabled/dav_svn.conf

# dav_svn.conf - Example Subversion/Apache configuration

#

# For details and further options see the Apache user manual and

# the Subversion book.

#

# NOTE: for a setup with multiple vhosts, you will want to do this

# configuration in /etc/apache2/sites-available/*, not here.

# <Location URL> ... </Location>

# URL controls how the repository appears to the outside world.

# In this example clients access the repository as http://hostname/svn/
# Note, a literal /svn should NOT exist in your document root.

<Location /svn>

# Uncomment this to enable the repository

DAV svn

# Set this to the path to your repository

#SVNPath /var/lib/svn

# Alternatively, use SVNParentPath if you have multiple repositories under

# under a single directory (/var/lib/svn/repo1, /var/lib/svn/repo2, ...).

# You need either SVNPath and SVNParentPath, but not both.

SVNParentPath /svn/repo

# Access control is done at 3 levels: (1) Apache authentication, via

# any of several methods. A "Basic Auth" section is commented out

# below. (2) Apache <Limit> and <LimitExcept>, also commented out

# below. (3) mod_authz_svn is a svn-specific authorization module

# which offers fine-grained read/write access control for paths

# within a repository. (The first two layers are coarse-grained; you

# can only enable/disable access to an entire repository.) Note that

# mod_authz_svn is noticeably slower than the other two layers, so if

# you don't need the fine-grained control, don't configure it.

# Basic Authentication is repository-wide. It is not secure unless

# you are using https. See the 'htpasswd' command to create and

# manage the password file - and the documentation for the

# 'auth_basic' and 'authn_file' modules, which you will need for this

# (enable them with 'a2enmod').

AuthType Basic

AuthName "Subversion Repository"

AuthUserFile /etc/apache2/dav/dav_svn.passwd

# To enable authorization via mod_authz_svn (enable that module separately):

<IfModule mod_authz_svn.c>

AuthzSVNAccessFile /etc/apache2/dav/dav_svn.authz

</IfModule>

# The following three lines allow anonymous read, but make

# committers authenticate themselves. It requires the 'authz_user'

# module (enable it with 'a2enmod').

<LimitExcept GET PROPFIND OPTIONS REPORT>

Require valid-user

</LimitExcept>

</Location>

2.2. create and add user

mkdir -p /etc/apache2/dav

htpasswd -c -m /etc/apache2/dav/dav_svn.passwd test1

htpasswd -m /etc/apache2/dav/dav_svn.passwd test2

htpasswd -m /etc/apache2/dav/dav_svn.passwd test3

htpasswd -m /etc/apache2/dav/dav_svn.passwd test4

htpasswd -m /etc/apache2/dav/dav_svn.passwd test5

htpasswd -m /etc/apache2/dav/dav_svn.passwd test6

2.3. edit /etc/apache2/dav/dav_svn.authz

[groups]

group1 = test1, test2

group2 = test3, test4, test5

group3 = test6, test7

[/]

* = r

@group1 = rw

test3 = rw

[IPCamera:/]

@group3 = rw

test1 = rw

test3 = r

[sandbox:/]

@group2 = rw

test6 = rw

3. configurate ssl

3.1 create ssl directory

mkdir /etc/apache2/ssl

3.2 create a self signed SSL certificate

apt-get install openssl

openssl req -x509 -nodes -days 3650 -newkey rsa:2048

-keyout /etc/apache2/ssl/apache2.key -out /etc/apache2/ssl/apache2.crt

Generating a 2048 bit RSA private key

...................................................................+++

................................................+++

writing new private key to '/etc/apache2/ssl/apache.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:CN

State or Province Name (full name) [Some-State]:Beijing

Locality Name (eg, city) []:Beijing

Organization Name (eg, company) [Internet Widgits Pty Ltd]:hfctech

Organizational Unit Name (eg, section) []:R&D

Common Name (e.g. server FQDN or YOUR name) []:svns

Email Address []:webmaster@hfctech.com

3.3 edit /etc/apache2/sites-available/default-ssl

ServerName svns

<IfModule mod_ssl.c>

<VirtualHost *:443>

ServerAdmin webmaster@svns.hfctech.com

DocumentRoot /var/www

<Directory />

Options FollowSymLinks

AllowOverride None

</Directory>

<Directory /var/www/>

Options Indexes FollowSymLinks MultiViews

AllowOverride None

Order allow,deny

allow from all

</Directory>

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/

<Directory "/usr/lib/cgi-bin">

AllowOverride None

Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch

Order allow,deny

Allow from all

</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log

# Possible values include: debug, info, notice, warn, error, crit,

# alert, emerg.

LogLevel warn

CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

Alias /doc/ "/usr/share/doc/"

<Directory "/usr/share/doc/">

Options Indexes MultiViews FollowSymLinks

AllowOverride None

Order deny,allow

Deny from all

Allow from 127.0.0.0/255.0.0.0 ::1/128

</Directory>

# SSL Engine Switch:

# Enable/Disable SSL for this virtual host.

SSLEngine on

# A self-signed (snakeoil) certificate can be created by installing

# the ssl-cert package. See

# /usr/share/doc/apache2.2-common/README.Debian.gz for more info.

# If both key and certificate are stored in the same file, only the

# SSLCertificateFile directive is needed.

SSLCertificateFile /etc/apache2/ssl/apache2.crt

SSLCertificateKeyFile /etc/apache2/ssl/apache2.key

#SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem

#SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

# Server Certificate Chain:

# Point SSLCertificateChainFile at a file containing the

# concatenation of PEM encoded CA certificates which form the

# certificate chain for the server certificate. Alternatively

# the referenced file can be the same as SSLCertificateFile

# when the CA certificates are directly appended to the server

# certificate for convinience.

#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt

# Certificate Authority (CA):

# Set the CA certificate verification path where to find CA

# certificates for client authentication or alternatively one

# huge file containing all of them (file must be PEM encoded)

# Note: Inside SSLCACertificatePath you need hash symlinks

# to point to the certificate files. Use the provided

# Makefile to update the hash symlinks after changes.

#SSLCACertificatePath /etc/ssl/certs/

#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt

# Certificate Revocation Lists (CRL):

# Set the CA revocation path where to find CA CRLs for client

# authentication or alternatively one huge file containing all

# of them (file must be PEM encoded)

# Note: Inside SSLCARevocationPath you need hash symlinks

# to point to the certificate files. Use the provided

# Makefile to update the hash symlinks after changes.

#SSLCARevocationPath /etc/apache2/ssl.crl/

#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl

# Client Authentication (Type):

# Client certificate verification type and depth. Types are

# none, optional, require and optional_no_ca. Depth is a

# number which specifies how deeply to verify the certificate

# issuer chain before deciding the certificate is not valid.

#SSLVerifyClient require

#SSLVerifyDepth 10

# Access Control:

# With SSLRequire you can do per-directory access control based

# on arbitrary complex boolean expressions containing server

# variable checks and other lookup directives. The syntax is a

# mixture between C and Perl. See the mod_ssl documentation

# for more details.

#<Location />

#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \

# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \

# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \

# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \

# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \

# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/

#</Location>

# SSL Engine Options:

# Set various options for the SSL engine.

# o FakeBasicAuth:

# Translate the client X.509 into a Basic Authorisation. This means that

# the standard Auth/DBMAuth methods can be used for access control. The

# user name is the `one line' version of the client's X.509 certificate.

# Note that no password is obtained from the user. Every entry in the user

# file needs this password: `xxj31ZMTZzkVA'.

# o ExportCertData:

# This exports two additional environment variables: SSL_CLIENT_CERT and

# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the

# server (always existing) and the client (only existing when client

# authentication is used). This can be used to import the certificates

# into CGI scripts.

# o StdEnvVars:

# This exports the standard SSL/TLS related `SSL_*' environment variables.

# Per default this exportation is switched off for performance reasons,

# because the extraction step is an expensive operation and is usually

# useless for serving static content. So one usually enables the

# exportation for CGI and SSI requests only.

# o StrictRequire:

# This denies access when "SSLRequireSSL" or "SSLRequire" applied even

# under a "Satisfy any" situation, i.e. when it applies access is denied

# and no other module can change it.

# o OptRenegotiate:

# This enables optimized SSL connection renegotiation handling when SSL

# directives are used in per-directory context.

#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire

<FilesMatch "\.(cgi|shtml|phtml|php)$">

SSLOptions +StdEnvVars

</FilesMatch>

<Directory /usr/lib/cgi-bin>

SSLOptions +StdEnvVars

</Directory>

# SSL Protocol Adjustments:

# The safe and default but still SSL/TLS standard compliant shutdown

# approach is that mod_ssl sends the close notify alert but doesn't wait for

# the close notify alert from client. When you need a different shutdown

# approach you can use one of the following variables:

# o ssl-unclean-shutdown:

# This forces an unclean shutdown when the connection is closed, i.e. no

# SSL close notify alert is send or allowed to received. This violates

# the SSL/TLS standard but is needed for some brain-dead browsers. Use

# this when you receive I/O errors because of the standard approach where

# mod_ssl sends the close notify alert.

# o ssl-accurate-shutdown:

# This forces an accurate shutdown when the connection is closed, i.e. a

# SSL close notify alert is send and mod_ssl waits for the close notify

# alert of the client. This is 100% SSL/TLS standard compliant, but in

# practice often causes hanging connections with brain-dead browsers. Use

# this only for browsers where you know that their SSL implementation

# works correctly.

# Notice: Most problems of broken clients are also related to the HTTP

# keep-alive facility, so you usually additionally want to disable

# keep-alive for those clients, too. Use variable "nokeepalive" for this.

# Similarly, one has to force some clients to use HTTP/1.0 to workaround

# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and

# "force-response-1.0" for this.

BrowserMatch "MSIE [2-6]" \

nokeepalive ssl-unclean-shutdown \

downgrade-1.0 force-response-1.0

# MSIE 7 and newer should be able to use keepalive

BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

SSLProtocol all

SSLCipherSuite HIGH:MEDIUM

</VirtualHost>

</IfModule>

4. restart apache2

service apache2 restart

5. solve warning

5.1 qualified domain name

apache2: Could not reliably determine the server's fully

qualified domain name, using 172.31.0.55 for ServerName

solved:

5.1.1 edit /etc/hosts

add a line to /etc/hosts, e.g.

172.31.0.55 svns svns.hfctech.com

5.1.2 edit /etc/apache2/sites-available/default

add a line on top of /etc/apache2/site-available/default, i.e.

ServerName svns

5.1.3 edit /etc/apache2/sites-available/default-ssl

add a line on top of /etc/apache2/site-available/default-ssl, i.e.

ServerName svns

5.2 overlap on port 443

apache2 [warn] _default_ VirtualHost overlap on port 443, the first has precedence

solved:

5.2.1 edit /etc/apache2/ports.conf

add a line NameVirtualHost on ssl module, i.e.

<IfModule mod_ssl.c>

#a line below added

NameVirtualHost *:443

Listen 443

</IfModule>

6. appendix /etc/apache2/sites-available/default file content

ServerName svns

<VirtualHost *:80>

ServerAdmin webmaster@localhost

DocumentRoot /var/www

<Directory />

Options FollowSymLinks

AllowOverride None

</Directory>

<Directory /var/www/>

Options Indexes FollowSymLinks MultiViews

AllowOverride None

Order allow,deny

allow from all

</Directory>

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/

<Directory "/usr/lib/cgi-bin">

AllowOverride None

Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch

Order allow,deny

Allow from all

</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log

# Possible values include: debug, info, notice, warn, error, crit,

# alert, emerg.

LogLevel warn

CustomLog ${APACHE_LOG_DIR}/access.log combined

Alias /doc/ "/usr/share/doc/"

<Directory "/usr/share/doc/">

Options Indexes MultiViews FollowSymLinks

AllowOverride None

Order deny,allow

Deny from all

Allow from 127.0.0.0/255.0.0.0 ::1/128

</Directory>

</VirtualHost>