Version Control with Subversion - Login

Server ConfigurationOnce you've settled on one of these three basic httpd.conf templates, you need to createyour file containing access rules for particular paths within the repository. We describethis later in this chapter, in the section called “Path-Based Authorization”.Disabling path-based checksThe mod_dav_svn module goes through a lot of work to make sure that data you'vemarked “unreadable” doesn't get accidentally leaked. This means it needs to closely monitorall of the paths and file-contents returned by commands such as svn checkout and svnupdate. If these commands encounter a path that isn't readable according to some authorizationpolicy, the path is typically omitted altogether. In the case of history or rename tracing—forexample, running a command such as svn cat -r OLD foo.c on a file thatwas renamed long ago—the rename tracking will simply halt if one of the object's formernames is determined to be read-restricted.All of this path checking can sometimes be quite expensive, especially in the case of svnlog. When retrieving a list of revisions, the server looks at every changed path in each revisionand checks it for readability. If an unreadable path is discovered, it's omitted from thelist of the revision's changed paths (normally seen with the --verbose option), and thewhole log message is suppressed. Needless to say, this can be time-consuming on revisionsthat affect a large number of files. This is the cost of security: even if you haven't configureda module such as mod_authz_svn at all, the mod_dav_svn module is still askingApache httpd to run authorization checks on every path. The mod_dav_svn module hasno idea what authorization modules have been installed, so all it can do is ask Apache toinvoke whatever might be present.On the other hand, there's also an escape hatch of sorts, which allows you to trade securityfeatures for speed. If you're not enforcing any sort of per-directory authorization (i.e., notusing mod_authz_svn or similar module), you can disable all of this path checking. In yourhttpd.conf file, use the SVNPathAuthz directive as shown in Example 6.4, “Disablingpath checks altogether”.Example 6.4. Disabling path checks altogetherDAV svnSVNParentPath /var/svnSVNPathAuthz offThe SVNPathAuthz directive is “on” by default. When set to “off,” all path-based authorizationchecking is disabled; mod_dav_svn stops invoking authorization checks on everypath it discovers.Extra GoodiesWe've covered most of the authentication and authorization options for Apache andmod_dav_svn. But there are a few other nice features that Apache provides.Repository browsing179