Is there a general rule of thumb when it comes to administrating SVN user passwords, should it be necessary that they must meet complexity requirements?
closed as too broad by Neil Smithline, TildalWave, Mark Buffalo, Iszi, Xander Feb 18 '16 at 19:29
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Presumably you are using svn to keep source code or configuration data or something similar, and having an unauthorized modification would be bad. Passwords are just one layer of security in protecting from an unauthorized modification.
So the rule of thumb would be to have "good" passwords. I personally dislike "complexity requirements", as most people doing this ignore that it's about entropy and not complexity:
- Why do password strength requirements exist?
- XKCD #936: Short complex password, or long dictionary passphrase?
But if your svn repository is susceptible to a brute force attack (eg, on the internet) you probably don't want your users to have passwords like "1234" or "password".
In addition to that though, you should consider:
- Putting the svn behind a firewall, accessible only to internal network
- Using SSH keys for authentication instead of passwords
- Having branch permissions and a code review process to prevent unwanted changes from getting in the mainline / "trunk" source code