Re: Subversion authentication security issue (svnserve, MITM)

2015-01-16 Thread Stefan Sperling
On Fri, Jan 16, 2015 at 10:35:46AM +0300, Navrotskiy Artem wrote: > Hello. > > Subversion includes many types of connection: > > * svnserve - plain password over network > * svnserve + ssh - secure, but unusable slow > * http - plain password over network > * https - secure > > In the case o

Re: Time to branch 1.9

2015-01-16 Thread Branko Čibej
A couple months down the line, and I'd like to make another call for creating the 1.9 release branch. AFAICS the x509 branch still needs merging if we want it in 1.9 (which I think we do, since IIUC trunk currently does not handle all certs correctly). Anything else? I'd like to propose that we c

Re: Time to branch 1.9

2015-01-16 Thread Julian Foad
Branko Čibej wrote: > A couple months down the line, and I'd like to make another call for > creating the 1.9 release branch. AFAICS the x509 branch still needs > merging if we want it in 1.9 (which I think we do, since IIUC trunk > currently does not handle all certs correctly). > > Anything else

Re: Time to branch 1.9

2015-01-16 Thread Stefan Fuhrmann
On Fri, Jan 16, 2015 at 11:06 AM, Branko Čibej wrote: > A couple months down the line, and I'd like to make another call for > creating the 1.9 release branch. AFAICS the x509 branch still needs > merging if we want it in 1.9 (which I think we do, since IIUC trunk > currently does not handle all

Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-16 Thread Ivan Zhakov
When doing operations like 'svn log' or 'svn ls' Subversion hides paths that are unreadable for user. I.e. if repository contains the following directories: /public /private And authorization file looks like this: [/] * = r [/private] * = Then 'svn ls REPOROOT' command will return only /public d

Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-16 Thread C. Michael Pilato
On 01/16/2015 02:18 PM, Ivan Zhakov wrote: > But I'm not sure that current behavior is the best. I'm thinking to > implement the following logic in mod_authz_svn: use different log > level whether access denied for subrequest or for primary request (the > URL user actually tried to access). > > Doe

Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-16 Thread Branko Čibej
On 16.01.2015 20:52, C. Michael Pilato wrote: > On 01/16/2015 02:18 PM, Ivan Zhakov wrote: >> But I'm not sure that current behavior is the best. I'm thinking to >> implement the following logic in mod_authz_svn: use different log >> level whether access denied for subrequest or for primary request

Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-16 Thread Ben Reser
On 1/16/15 11:52 AM, C. Michael Pilato wrote: > As for log levels, is there any reason to log the implicit read attempts > at a level higher than "debug"? I have no opinion about the log level > for the explicit ones. I can see some people possibly wanting this information for auditing purposes.