Repositories access control with apache mod dav svn and mod perl » History » Revision 37
« Previous |
Revision 37/47
(diff)
| Next »
Mischa The Evil, 2011-11-16 03:48
Roll-back to page version 32 since last four edits were containing spam and defacements.
Repositories access control with apache, mod_dav_svn and mod_perl¶
- Table of contents
- Repositories access control with apache, mod_dav_svn and mod_perl
Overview¶
In this documentation, we will configure apache to delegate authentication to mod_perl. It's tested on apache2 (apache2-mpm-prefork
) with mysql and postgresql but should work with allmost every databases for which there is a perl DBD module. Apache2 with the high speed thread model might not load Perl correctly (apache2-mpm-worker
).
You need a working apache on your SVN server and you must install some modules at least mod_dav_svn, mod_perl2, DBI and DBD::mysql (or the DBD driver for you database as it should work on allmost all databases).
On Debian/ubuntu you can do :
sudo aptitude install libapache2-svn libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl libdigest-sha1-perl libauthen-simple-ldap-perl
If the repositories are not created automatically by reposman.rb, it is important that the repository name is the same as the project identifier in Redmine, otherwise Redmine.pm will fail to authenticate users. For example, if the path to the repository is /path/to/repository/foo-bar
, then the project Identifier on the Settings page must be foo-bar
.
Enabling apache modules¶
On debian/ubuntu :
sudo a2enmod dav sudo a2enmod dav_svn # if you want to use svn sudo a2enmod dav_fs # if you want to use git sudo a2enmod perl
Apache configuration for Subversion repositories¶
You first need to copy or linkRedmine.pm
to /usr/lib/perl5/Apache/Redmine.pm
- Redmine.pm can be found in $REDMINE_DIR/extra/svn/Redmine.pm
- In the Debian install, it is found /usr/share/redmine/extra/svn/Redmine.pm
Then add the following Location directives to your apache configuration (for example in /etc/APACHE_DIR/conf.d/
):
- the old how-to which suggested two separate locations for with
/svn
and/svn-private
can be avoided - with the
Satisfy any
keyword from Apache you can define different authentication policies - read access from the redmine-server or any validated user
- write access only validated users
# /svn location for users PerlLoadModule Apache::Redmine <Location /svn> DAV svn SVNParentPath "/var/svn" Order deny,allow Deny from all Satisfy any PerlAccessHandler Apache::Authn::Redmine::access_handler PerlAuthenHandler Apache::Authn::Redmine::authen_handler AuthType Basic AuthName "Redmine SVN Repository" #read-only access <Limit GET PROPFIND OPTIONS REPORT> Require valid-user Allow from redmine.server.ip # Allow from another-ip Satisfy any </Limit> # write access <LimitExcept GET PROPFIND OPTIONS REPORT> Require valid-user </LimitExcept> ## for mysql RedmineDSN "DBI:mysql:database=databasename;host=my.db.server" ## for postgres # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server" ## for SQLite3 # RedmineDSN "DBI:SQLite:dbname=database.db" RedmineDbUser "redmine" RedmineDbPass "password" </Location>
Testing the configuration:¶
After reloading apache conf, you can try to browse some repository with:
svn ls http://my.svn.server/svn/myproject
Any non-public repository should ask for a username and password.
To test the authentication that allows you redmine server to read all repositories:
Reading a private repository:
svn ls http://my.svn.server/svn/myproject
Try writing to the repository:
svn mkdir http://my.svn.server/svn/myproject/testdir
This should fail and ask for a password.
optional LDAP Authentication¶
If you want to connect your LDAP authentication to Apache, you can install the Authen::Simple::LDAP perl module. I found that connecting to my LDAP server to authenticate with every request can be quite slow. I added the following to my configuration and had a significant performance increase. If you have configured an encrypted connection to the LDAP server you will need the IO::Socket::SSL module.
NOTE: the above wording is a little confusing. I attempt to clear up the issues I had with this in the following paragraph.
First of all, make sure that you have the Net::LDAP module installed as well. I installed Authen::Simple::LDAP through CPAN and found that nothing worked. Eventually I figured out that this was because the Authen::Simple::LDAP did not require the Net::LDAP module as a dependency but it is needed for our purpose here. I did this on CentOS and it seems that the Net::LDAP module can be installed via yum (
yum install perl-LDAP
) but the Authen::Simple::LDAP had to be installed via CPAN since there's no RPM for it in the CentOS repositories.
To install the Authen::Simple::LDAP using CPAN use commands:
cpan cpan> install Authen::Simple::LDAP
if the installation failed due to some dependencies, resolve the dependencies first.
My second point is related to the below Apache config. The
PerlLoadModule Authen::Simple::LDAP
is actually not required for having users authenticated via LDAP. It will happen automatically if both of the above modules are installed. So there really is no difference between the config snippet below and the one above except for theRedmineCacheCredsMax 50
line which is probably a good idea although it can result in users that have been deleted or removed in redmine still getting access to the repositories, at least for a little while.
PerlLoadModule Apache::Redmine PerlLoadModule Authen::Simple::LDAP # PerlLoadModule IO::Socket::SSL <Location /svn> DAV svn SVNParentPath "/var/svn" AuthType Basic AuthName redmine Require valid-user PerlAccessHandler Apache::Authn::Redmine::access_handler PerlAuthenHandler Apache::Authn::Redmine::authen_handler ## for mysql RedmineDSN "DBI:mysql:database=databasename;host=my.db.server" ## for postgres # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server" RedmineDbUser "redmine" RedmineDbPass "password" #Cache the last 50 auth entries RedmineCacheCredsMax 50 </Location>
Apache configuration for Git repositories¶
Now that reposman.rb can create git repositories, you can use Redmine.pm to access them the same way than subversion.
You first need to copy or link Redmine.pm to /usr/lib/perl5/Apache/Redmine.pm, then you add this configuration to apache :
PerlLoadModule Apache::Authn::Redmine SetEnv GIT_PROJECT_ROOT /path/to/git/repos SetEnv GIT_HTTP_EXPORT_ALL ScriptAlias /git/ /usr/bin/git-http-backend/ <Location /git> AuthType Basic Require valid-user AuthName "Git" PerlAccessHandler Apache::Authn::Redmine::access_handler PerlAuthenHandler Apache::Authn::Redmine::authen_handler RedmineDSN "DBI:mysql:database=redmine;host=localhost" RedmineDbUser "redmine" RedmineDbPass "password" RedmineGitSmartHttp yes </Location> Alias /git-private /var/git <Location /git-private> Order deny,allow Deny from all <Limit GET PROPFIND OPTIONS REPORT> Options Indexes FollowSymLinks MultiViews Allow from 127.0.0.1 </Limit> </Location>
To verify that you can access repository through Redmine.pm, you can use curl :
% curl --netrc --location http://localhost/git/ecookbook/HEAD ref: refs/heads/master
Apache configuration for Mercurial repositories¶
Create a file caled "hgweb.config" in the same folder as "hgwebdir.cgi". This foder will be the root repository folder. Then edit the "hgweb.config" with something like this:
[paths] /=/path/to/root/repository/** [web] allow_push = * allowbz2 = yes allowgz = yes allowzip = yes
Follows the instructions to install Redmine.pm as described and configure your apache like this.
RewriteEngine on PerlLoadModule Apache2::Redmine PerlLoadModule Authen::Simple::LDAP ScriptAliasMatch ^/hg(.*) /path/to/the/hgwebdir.cgi/$1 <Location /hg> AuthType Basic AuthName "Mercurial" Require valid-user #Redmine auth PerlAccessHandler Apache::Authn::Redmine::access_handler PerlAuthenHandler Apache::Authn::Redmine::authen_handler RedmineDSN "DBI:mysql:database=redmine;host=localhost" RedmineDbUser "DB_USER" RedmineDbPass "DB_PASSWD" </Location> # Note: Do not use hg-private as the rewrite rule above will cause strange things to occur. Alias /private-hg /path/to/hg/repos <Location /private-hg> Order deny, allow Deny from all <Limit GET PROPFIND OPTIONS REPORT> Options Indexes FollowSymLinks MultiViews Allow from 127.0.0.1 </Limit> </Location>
Gotchas¶
If you run this in Phusion Passenger, make sure you don't turn PassengerHighPerformance on. If you do, the rewrites to catch subversion dav will be bypassed with some interesting dump in the log as a result.
Example:
ActionController::RoutingError (No route matches "/svn/rm-code" with {:method=>:get}):
(if your repo are named rm-code)
When using Authen::Simple::LDAP
for authentication, it is not sufficient to have the Administrator role to access a repository. The user must have a role with that specifically allows the user to browse, read, or write the repository.
Updated by Mischa The Evil almost 13 years ago · 37 revisions