svnserve Configuration

The svnserve program is a lightweight server, capable of speaking to clients over TCP/IP using a custom, stateful protocol. Clients contact an svnserve server by using URLs that begin with the svn:// or svn+ssh:// scheme

There are a few different ways to run the svnserve program:

• Run svnserve as a standalone daemon, listening for requests.
• Have the Unix inetd daemon temporarily spawn svnserve whenever a request comes in on a certain port.
• Have SSH invoke a temporary svnserve over an encrypted tunnel.
• Run svnserve as a Microsoft Windows service.

svnserve as Daemon

The easiest option is to run svnserve as a standalone “daemon” process. Use the -d option for this. svnserve is listening on port 3690:

bash$ svnserve -d

Some options for svnserve daemon:

• --listen-port : specified the port number
• --listen-host : specified the hostname to bind to
• -r /var/svn : modifies the location that the program treats as the root of the remote filesystem space.

Built-in Authentication and Authorization

When a client connects to an svnserve process, the following things happen:

• The client selects a specific repository.
• The server processes the repository's conf/svnserve.conf file and begins to enforce any authentication and authorization policies it describes.
• Depending on the defined policies, one of the following may occur:
  • The client may be allowed to make requests anonymously, without ever receiving an authentication challenge.
  • The client may be challenged for authentication at any time.
  • If operating in tunnel mode, the client will declare itself to be already externally authenticated (typically by SSH).

Setting Access Control

The [general] section of svnserve.conf has all the variables you should start from.

[general]

# anonymous user aren't allowed

anon-access = none

# authentication users can both read and write

auth-access = write

# file that contains a list of usernames and passwords, the default name is passwd located inside the conf directory

password-db = /path/to/password/file

# file for specifying access rules for specific locations, it's a path-base authentication, the default name is authz located inside the conf directory

authz-db = /path/to/authz/file

The password-db file contains a list of usernames and passwords. This file can be share across all repositories or you can make it specific to certain repository. If you simply use the passwd file without any path, then you are using it for just that particular repository.

[users]

username1 = password1

username2 = password2

dev1 = devpassword1

dev2 = devpassword2

The authz-db contains path-base authentication. The file can be used to define finer-grained access rules. Again, this file can be share across all the repositories just like the passwd file.

[groups]

developers = dev1, dev2

stdusers = username1, username2

everyone = @developers, username1, username2

# Give read permission to all users at the root of the repository

[/]

* = r

# Access rules to repos01, allow read/write to developers group and read only for stdusers to the root of repos01 repository

[/var/svn/repos/repos01:/]

@developers = rw

@stdusers = r

# Allow read/write for stdusers to repos01/trunk directory

[/var/svn/repos/repos01:/trunk]

@stdusers = rw