Secured Subversion on Windows
Recently I decided that I want to move to Subversion 1.1, and have a central repository that manages all my code. The main reason for this was that I got myself a laptop, so having a file-based repository1 that I can access from my laptop.
Being security minded person, I want to tunnel this through SSH, so nobody could look at my valuable code - I'm currently implementing bogo-sort, no less :-)
There are many easy way to do this, but I wanted to use the most direct way, which is a
Sadly, I'm not a *nix guy, so my server is going to be a WinXp Pro machine, but I could find no resource whatsoever that support it without installing Apache2 on my computer. As I mention previously, I don't like to install more than what is absolutely necessary. I want to use svnserve with SSH. It's easy to get a detailed guide on how to do it on *nix, but on windows? Compelete silence.
TortoiseSVN mentions that this is possible, but leave it as an excerise for the reader.
Here are the steps needed:
SSH Server for windows - Checked, I got OpenSSH for Windows
- Comes with an installer.
- Install client tools (or can install only them).
- Run as a service.
- Has readable quick start guide that actually works (not so sommon in software from sourceforge :-) )
Install it on the server ( as administrator)
Go to the installation directory and run the following commands (covered in the quick start guide):
Make sure to run those commands as administrator, otherwise you may get weird failures.
This assumes that you want local users & groups, for domain user & groups, run those same commands, but the "-d" paramter
- mkgroup -l >> ..\etc\group
- mkpasswd -l >> ..\etc\passwd
Run net start opensshd (again, as admin)
Be aware that the ssh server is not automatically started, so you may want to change that on services.msc
Verify that you can connect to the ssh server by issuing the following command "ssh localhost". You should get a disclaimer about accessing the system and a password prompt. Enter your password and verify that you can log in.
Now, open <OpenSSH installation directory>\etc\banner.txt in notepad and delete all the text, save and exit notepad.
The reason for this is that subversion expect only the password prompt and when it encounter the banner's content it chokes.
The next step is to issue this command "ssh localhost svnserve -t"
You should get a password prompt and a response similar to this:
( success ( 1 2 ( ANONYMOUS EXTERNAL ) ( edit-pipeline ) ) )
This means that you can connect to the repository over ssh, now all that remains is to make subversion itself talk to the ssh server.
Here we have a problem, the problem will happen in one of two cases:
- Your repository is located on a different drive then the SSH Server.
- You don't want to use paths like svn+ssh://server/path/to/repos/
So, what need to be done? svnserve (the process that implement the remote connection) accept a -r parameter that allows it to spesify a root for the repository.
The problem is that you cannot specify the -r paramter in the client, because that is hard coded. The docs say that you need to create a wrapper script around it that would set the proper parameters, The problem is that such a method doesn't work on windows, probably because of the way the SSH server attempts to run the command.
There are many ways to solve this, here is a(n incomplete) list:
- Edit $HOME/.ssh/autorized_keys2 so that whenever you log with a spesific key the SSH server will call svnserve -r x:\path\to\repos instead of the usual shell.
- Edit C:\Program Files\OpenSSH\etc\passwd so that whenever a spesific user(s) log in, they will get svnserve -r x:\path\to\repos
- Create an executable that will call svnserve properly.
I didn't go with the first option because it seems too much for me. The second option forces me to only use subversion or to use some sort of a switcher executable.
This third option took me some time to get right3, but the short version is that you can download the result here.
Download the file, extract it and put it in Subversion bin directory (default: C:\Program Files\Subverion\bin\).
Rename svnserve.exe svnserve2.exe
Rename svnproxy.exe svnserve.exe
Create a file named redirect.inf in the same directory and in it put the following:
svnserve2 -r x:\path\to\repos
Now you should've everything that you need in order to use svn client to connect to your repository over ssh.
Verify that you can use svn+ssh by issuing the following command:
svn list svn+ssh://localhost/
You should see the familiar listing of your versioned files.
Additional things you might need to do are:
- Setup a firewall rule allowing transfer from port 22 (I set it up to allow only my own subnet, but it is okay to expose it to everyone.
- You might want to add your SSH server key to the list of known keys on all the machines that you'll use to access the repository, it's not technically needed, but it would avoid getting that pesky warning about an unknown key and may avoid man-in-the-middle attacks later on.
- Set OpenSSH as an automatic server (in case you reboot and then can't find the server, that is because the SSH server is not on, you would need to manually start it using: net start opensshd
1I keep getting confused between 'repository' and 'respitory' (or is it 'respiratory') :-)
2$HOME in windows points to C:\Documents And Settings\<User Name>\
3For a full disclosure of how I solved this, go here
Comments
Comment preview