Project

General

Profile

HowTo to handle SVN repositories creation and access control with Redmine » History » Version 20

Art Kuo, 2012-06-03 05:47

1 20 Art Kuo
h1. HowTo to handle SVN repositories creation and access control with Redmine (part 1)
2 1 Jean-Philippe Lang
3 18 Knight Samar
*This setup is deprecated, you should try [[Repositories_access_control_with_apache_mod_dav_svn_and_mod_perl]]*
4
5 2 Jean-Philippe Lang
{{>TOC}}
6 17 Nicolas Chuche
7
8 1 Jean-Philippe Lang
h2. Overview
9
10
*This setup is not required if you just need to browse your repositories and changesets from Redmine.*
11
12
As of version 0.5.0, Redmine is able to handle Subversion repositories creation and access control.
13
14 17 Nicolas Chuche
Once you've done this extra setup, Redmine will create the repository for each of your projects. Users will be allowed to access the repositories using ssh+svn, according to their permissions defined in Redmine :
15 1 Jean-Philippe Lang
16
* for public projects : read access to the repository for any user, write access for project members only,
17
* for private projects : read/write access allowed to project members only.
18
19 8 Jean-Philippe Lang
User authentication is done using the same login/password as for Redmine access.
20 1 Jean-Philippe Lang
21
h2. Requirements
22
23
h3. Software
24
25
You need Redmine 0.5.0 or higher, running with MySQL[1].
26
27 5 Jean-Philippe Lang
Your SVN repositories must be hosted on a *nix system with the following packages:
28
* nss_mysql
29 19 Eugenio Piasini
* pam_mysql 0.7pre2 or higher, compiled with SHA1 support (note that if using Redmine >= 1.2, due to the use of "salt" when storing hashed passwords, pam_mysql has to be patched with AxeldV's "patch":http://www.redmine.org/boards/2/topics/24383?r=26204#message-26204)
30 1 Jean-Philippe Lang
31
Scripts used in this HowTo can be found in the /extra/svn directory of Redmine.
32
33 5 Jean-Philippe Lang
In this HowTo, we assume that:
34
* the redmine database is called @redmine@ and hosted on @localhost@
35
* the Subversion repositories are located in @/var/svn@
36
37 1 Jean-Philippe Lang
h3. Network considerations
38
39 5 Jean-Philippe Lang
The SVN host must be able to access both the Redmine database and HTTP server(s). In many cases, they will all be located on the same host.
40 1 Jean-Philippe Lang
41
h2. Setup
42
43 5 Jean-Philippe Lang
h3. Installing requires packages
44
45
Get nss_mysql and other necessary packages:
46
47 14 Jean-Philippe Lang
  apt-get install build-essential libnss-mysql libpam0g-dev libssl-dev libmysqlclient15-dev
48 5 Jean-Philippe Lang
49
Get and build @pam_mysql@:
50
51
<pre>
52
$ cd /usr/src
53
$ wget http://prdownloads.sourceforge.net/pam-mysql/pam_mysql-0.7RC1.tar.gz
54
$ tar xzf pam_mysql-0.7RC1.tar.gz
55
$ cd pam_mysql-0.7RC1
56
$ ./configure --with-openssl
57
$ make && make install
58
</pre>
59
60 1 Jean-Philippe Lang
h3. Preparing the Redmine database
61
62
Some views need to be added to the Redmine database. These views are used to authenticate users and retrieve their permissions.
63
64 3 Jean-Philippe Lang
1. Create the different views in your Redmine database :
65 1 Jean-Philippe Lang
66 7 Jean-Philippe Lang
  mysql --user=root redmine -p < create_views.sql
67 1 Jean-Philippe Lang
68 7 Jean-Philippe Lang
2. Create and grant privileges to 2 new mysql users (@redmine_nss@ and @redmine_pam@):
69 1 Jean-Philippe Lang
70
<pre>
71 7 Jean-Philippe Lang
mysql --user=root -p
72 1 Jean-Philippe Lang
mysql> create user redmine_nss@localhost identified by 'averylongpassword';
73
mysql> grant SELECT on redmine.nss_groups to redmine_nss@localhost;
74
mysql> grant SELECT on redmine.nss_users to redmine_nss@localhost;
75
mysql> grant SELECT on redmine.nss_grouplist to redmine_nss@localhost;
76 4 Jean-Philippe Lang
mysql> create user redmine_pam@localhost identified by 'averylongpassword';
77
mysql> grant SELECT on redmine.ssh_users to redmine_pam@localhost;
78 1 Jean-Philippe Lang
</pre>
79
80 8 Jean-Philippe Lang
h3. Configuring nss-mysql
81 1 Jean-Philippe Lang
82
3. Create the /etc/nss-mysql.conf as follows:
83
84
<pre>
85
conf.version = 2;
86
users.host = inet:localhost:3306;
87
users.database = redmine;
88
users.db_user = redmine_nss;
89 4 Jean-Philippe Lang
users.db_password = averylongpassword;
90 1 Jean-Philippe Lang
users.backup_database = nss_mysql_backup;
91
users.table = nss_users;
92
users.user_column = nss_users.username;
93 9 Jean-Philippe Lang
users.userid_column = nss_users.username;
94 1 Jean-Philippe Lang
users.uid_column = nss_users.uid;
95
users.gid_column = 100;
96
users.realname_column = nss_users.realname;
97
users.homedir_column = "/false/path";
98
users.shell_column = "/usr/local/bin/svnserve.wrapper";
99
groups.group_info_table = nss_groups;
100
groups.group_name_column = nss_groups.name;
101
groups.groupid_column = nss_groups.gid;
102
groups.gid_column = nss_groups.gid;
103
groups.password_column = "x";
104
groups.members_table = nss_grouplist;
105
groups.member_userid_column = nss_grouplist.username;
106
groups.member_groupid_column = nss_grouplist.gid;
107
</pre>
108
109
4. Install the svnserve wrapper
110
111
  sudo install svnserve.wrapper /usr/local/bin
112
113 4 Jean-Philippe Lang
5. Change /etc/nsswitch.conf
114 1 Jean-Philippe Lang
115 16 Jean-Philippe Lang
Add “mysql” at the end of the two lines passwd and group like that :
116 1 Jean-Philippe Lang
117
<pre>
118
passwd:         compat mysql
119
group:          compat mysql
120
</pre>
121
122
6. Test that all this stuff works :
123
124
You must have users in some project to verify.
125
126
<pre>
127
% getent passwd
128
[...]
129
user1:x:5002:100:user1 user1:/false/path:/usr/local/bin/svnserve.wrapper
130
user2:x:5003:100:user2 user2:/false/path:/usr/local/bin/svnserve.wrapper
131
132
% getent group
133
[...]
134 5 Jean-Philippe Lang
project1:x:5001:
135
project2:x:5002:
136 1 Jean-Philippe Lang
</pre>
137
138
h3. Authorize ssh pam to use mysql
139
140 4 Jean-Philippe Lang
7. Add these lines in @/etc/pam.d/ssh@ :
141 1 Jean-Philippe Lang
142 4 Jean-Philippe Lang
<pre>
143
auth sufficient pam_mysql.so \
144
verbose=1 \
145
user=redmine_pam \
146
passwd=averylongpassword \
147
host=localhost \
148
db=redmine \
149
table=ssh_users \
150
usercolumn=username \
151
passwdcolumn=password crypt=4
152 1 Jean-Philippe Lang
153 4 Jean-Philippe Lang
account sufficient pam_mysql.so \
154
verbose=1 \
155
user=redmine_pam \
156
passwd=averylongpassword \
157
host=localhost \
158
db=redmine \
159
table=ssh_users \
160
usercolumn=username \
161
passwdcolumn=password crypt=4
162
163
password sufficient pam_mysql.so \
164
verbose=1 \
165
user=redmine_pam \
166
passwd=averylongpassword \
167
host=localhost \
168
db=redmine \
169
table=ssh_users \
170 1 Jean-Philippe Lang
usercolumn=username \
171
passwdcolumn=password crypt=4
172
</pre>
173
174
Juste before
175
176
  @include common-auth
177
178
8. Test this against an existing Redmine user
179
180 6 Jean-Philippe Lang
Try to connect to the SVN host using a Redmine username (eg. jsmith):
181 1 Jean-Philippe Lang
182 6 Jean-Philippe Lang
<pre>
183
$ ssh jsmith@localhost
184
jsmith@localhost's password:
185
Could not chdir to home directory /false/path: No such file or directory
186
( success ( 1 2 ( ANONYMOUS EXTERNAL ) ( edit-pipeline ) ) )
187
</pre>
188
189
The chdir error is the expected result.
190 1 Jean-Philippe Lang
191
h3. Automating repository creation
192
193 8 Jean-Philippe Lang
Repository creation can be automated by running periodically the reposman script.
194 1 Jean-Philippe Lang
195 5 Jean-Philippe Lang
It takes 2 arguments:
196 1 Jean-Philippe Lang
197 5 Jean-Philippe Lang
    * @svn-dir@: path to the directory where your svn repositories are located
198 1 Jean-Philippe Lang
    * @redmine-host@: host name of your Redmine install
199
200 15 Nicolas Chuche
Perl and Ruby versions of this script are provided but the perl version is now deprecated.
201 1 Jean-Philippe Lang
202 8 Jean-Philippe Lang
Example using the Ruby version:
203
204 1 Jean-Philippe Lang
<pre>
205 15 Nicolas Chuche
./reposman.rb --svn-dir=/var/svn --redmine-host=localhost
206 1 Jean-Philippe Lang
repository /var/svn/project2 created
207
repository /var/svn/project1 created
208
mode change on /var/svn/project3
209
</pre>
210
211
Projects are retrieved from Redmine using a SOAP web service. This web service is disabled by default in Redmine.
212 16 Jean-Philippe Lang
To enable it, go to “Administration -> Settings” and check *Enable WS for repository management*.
213 1 Jean-Philippe Lang
214 13 Nicolas Chuche
Make sure this option is checked if you get this error when running reposman:
215
@Service description 'http://localhost/sys/service.wsdl' can't be loaded: 404 Not Found@
216
217 12 Nicolas Chuche
With a recent version of redMine/reposman.rb (re. 860 and later), reposman.rb can register the new repository
218 1 Jean-Philippe Lang
in redMine so that you have nothing to do and set the owner of repository to who you want to allow browsing private
219 15 Nicolas Chuche
repository in redMine. You can do that by using the @--url@ argument :
220 1 Jean-Philippe Lang
221 15 Nicolas Chuche
<pre>
222
ruby ./reposman.rb --redmine-host localhost:3000 --svn-dir /var/svn \
223
                   --url file:///var/svn/
224
</pre>
225
226
reposman will send back to Redmine the url of your repository. *be careful* when testing, one registered, you can't change the url in redmine).
227
228
Next time you create a project, reposman will informe Redmine that the repository was created and Redmine will save the repository url.
229
This way, the administrator won't have to enter the repositories urls manually in Redmine.
230
231 5 Jean-Philippe Lang
h3. Accessing the repositories
232
233 10 Jean-Philippe Lang
You can now access project1 repository using this url:
234 1 Jean-Philippe Lang
235
  svn+ssh://svnhost/project1
236
237 15 Nicolas Chuche
h2. What if you want to allow Redmine to browse private repository ?
238
239
The previous recipes allow you to create repository on the fly and anonymous browsing. But, if your project is private or if the project isn't on the same server, you won't be able to browse it in Redmine.
240
241
h3. Redmine and svn are on the same server
242
243
In this case, you just need to use the @--url@ option like in the previous item to register the repository and the @--owner@ argument to set the repository owner to the mongrel/apache user so that it can access the repositories.
244
245
<pre>
246
ruby ./reposman.rb --redmine-host localhost:3000 --svn-dir /var/svn \
247
                   --url file:///var/svn/ --owner MONGREL_USER
248
</pre>
249
250
BUT, you won't be able to separate svn and Redmine hosts in the future (in fact you will be able to but you would have to manually update the repositories urls in the database and that's bad). A better way to do this, if you think you will need to separate those two servers one day, is to do like you already have two servers. To do this, read the next recipe.
251
252
h3. Redmine and svn aren't on the same server
253
254
There's more than one way to do this, one could be to use a specific user to browse the repository with svnserve or svn+ssh but I don't like this way (don't ask why). Another way is to add a third access way (we already have svn+ssh for registered users and svnserve for anonymous users).
255
256
In the following, the Redmine server is known as redmine.my.domain and the svn as svn.my.domain. You need to have apache/apache2 and mod_dav_svn on the svn server.
257
258
1. configure your apache to serve the svn repository just for the Redmine server
259
260
Just add something like that in your @apache.conf@ or in a file in the directory @/etc/apache/conf.d@:
261
262
<pre>
263
   LoadModule dav_svn_module /usr/lib/apache2/modules/mod_dav_svn.so
264
   <Location /svn>
265
   DAV svn
266
   # this must be the path you give to reposman with -s,--svn-dir argument
267
   SVNParentPath "/var/svn"
268
   Order allow,deny
269
   Allow from ip.of.my.redmine.server
270
   </Location>
271
</pre>
272
273
Verify you can access it from your Redmine server.
274
275
2. change your reposman cron by adding the @--owner@ argument with the apache user :
276
277
<pre>
278
ruby ./reposman.rb --redmine-host http://redmine.my.domain/ --svn-dir /var/svn
279
                   --url http://svn.my.domain/svn/ --owner APACHE_USER
280
</pre>
281
282
h2. Web Service and Security
283
284
For the moment, the WS is open to everybody once actived and you surely don't want that someone register project for you. You can block access to the WS with apache/mongrel (if you don't use apache, I let you do your homework...) with the Location apache directive like this :
285
286
<pre>
287
<VirtualHost *:80>
288
   ServerName redmine.my.domain
289
   ServerAdmin webmaster@localhost
290
291
   <Location /sys>
292
      Order allow,deny
293
      Allow from ip.of.my.svn.server
294
   </Location>
295
296
   ProxyPass / http://localhost:3000/
297
   ProxyPassReverse / http://localhost:3000/
298
</VirtualHost>
299
</pre>
300 5 Jean-Philippe Lang
301 16 Jean-Philippe Lang
fn1. Other databases can not be used because of various problems: no pam module, no sha1 handling,...