Subversion Repositories with Basic Authentication

The last two configurations however do not provide any security for our repository. A standard security practice is to use Basic authentication over https.

As a beginning we will set Basic authentication and the only members of svn group can access it. First we create the file for the user credentials and for the user groups.

# cd /usr/local/www/svn.basicauth/conf
# htpasswd -c users userone
# htpasswd -c users usertwo
# echo "svn: userone usertwo" >> groups

Next, we add the necessary Apache directives

<Location /svn>
  DAV svn
  SVNParentPath /usr/local/www/svn.basicauth/repos

  AuthType Basic
  AuthName "SVN Repository"
  AuthBasicProvider file
  AuthUserFile conf/users
  AuthGroupFile conf/groups
  Require group svn
</Location>

AuthType directive specifies the method that is used to authenticate the user and in this case it is Basic, that is implemented by mod_auth_basic. It is not a secure method sinse it transfer the passwords in almost plain text. This is we will enable SSL. AuthBasicProvider directive specify that the source for the user credentials is a file and AuthUserFile gives the location of that file; these directive require mod_authn_file. Similary, the file specified by AuthGroupFile contains the list of the groups and the users belonging to them and it needs mod_authz_groupfile. Finally, Require directive restricts the access to the repositories only to the members of svn group.