0

Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords should be stored. We never want a user to be able to do that.

There a possibility that users could bypass it and store their password in a plain text file anyways. If we disable the feature in the client binary, they'll download or compile a different client.

svn, version 1.7.14 (r1542130)    compiled Oct  7 2020, 22:48:31

which svn
/bin/svn

whereis svn
svn: /usr/bin/svn /usr/share/man/man1/svn.1.gz

Would encrypting the users' home directory to protect the passwords as well as the data work? If so, how to do that? Do I need to mount a new volume for encryption? what is the best approach here?

Is this approach solve my problem?

~/.subversion/servers:

[global]
# Password / passphrase caching parameters:
store-passwords = no
store-plaintext-passwords = no

[root@ip-10-0-16-165 auth]#

vi ~/.subversion/servers

[global]

store-passwords = yes

store-plaintext-passwords = no

In ~/.subversion/config

[auth]

store-passwords = yes

store-auth-creds = yes

password-stores = gnome-keyring , kwallet

I was thinking of encrypting the password files and add these encrypted files to SVN. For example you can encrypt with openssl:

Encrypt:

    openssl enc -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 -salt -in file1 -out file1_encrypted

Decrypt:

    openssl enc -aes-256-cbc -d -md sha512 -pbkdf2 -iter 100000 -salt -in file1_encrypted -out file1

But the question is whether the OpenSSH solution is whether we are decrypting the password from the file each time we need to use it? The GNOME keyring solution sounds like it would be easy for our developers to use. Are there any security issues with that?

What is the best approach here ?

8
  • Is the Amazon Linux 2 instance the SVN server?
    – Robert
    Apr 26 at 7:22
  • yes , I want to Encrypt the SVN User group(devs), but unable to figure out which one would be best fit OpenSSH or GNOME keyring solution, Are there any security issues with the GNOME keyring ? what is the best advise here ?
    – samtech
    Apr 26 at 7:31
  • You are talking about the SVN server, but SVN passwords are stored on client side not on server side (on server it depends on the SVN access protocol, for HTTP(S) they are stored hashed via hhtpasswd2). Also why would you install Gnome on a server? Therefore your question still makes no sense to me. Please write exactly if you are talking about client or server side.
    – Robert
    Apr 26 at 7:37
  • we provide our developer's group (devs) r-x and now we don't want that they will store the unencrypted passwords, if we disable/enable encrypted password store options, they just simply bypass that .so want the advice?
    – samtech
    Apr 26 at 7:49
  • Passwords are mainly used for SVN access via HTTPS. But SVN can also be use via SSH protocol (SVN+SSH Protocol) with public keys, in this case a password would only be needed to unlock the private key on client side.
    – Robert
    Apr 26 at 7:57

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.