Deny access to .svn folders on Apache

fuzzymonk_19839 0
Viewed 34528

We have a rails application in subversion that we deploy with Capistrano but have noticed that we can access the files in '/.svn', which presents a security concern.

I wanted to know what the best way to do this. A few ideas:

  • Global Apache configuration to deny access
  • Adding .htaccess files in the public folder and all subfolders
  • Cap task that changes the permissions

I don't really like the idea of deleting the folders or using svn export, since I would like to keep the 'svn info' around.

deployment capistrano svn apache
13 Answers

The best option is to use Apache configuration.

Using htaccess or global configuration depends mainly on if you control your server.

If you do, you can use something like

<DirectoryMatch .*\.svn/.*>
    Deny From All
</DirectoryMatch>

If you don't, you can do something similar in .htaccess files with FilesMatch

Vinko_Vrsalovic_51900

One other way to protect the .svn files would be to use a redirect in the Apache config:

RedirectMatch 404 /\\.svn(/|$)

So instead of getting a 403 forbidden (and providing clues to would be attackers) you get a 404, which is what we would expect when randomly typing in paths.

fuzzymonk_198390

A RedirectMatch will respond with a 404, which is great.

However, if "Options +Indexes" is enabled, then users will still be able to see the '.svn' directory from the Parent directory.

Users won't be able to enter the directory-- this is where the '404 Not Found' comes in. However, they will be able to see the directory and provide clues to would be attackers.

user_1102230

RedirectMatch like other directives from mod_alias is case sensitive even on case-insensitive file systems (see mod_alias documentation). So the answers above about matching and blocking files of all version control systems are not correct.

Instead of

RedirectMatch 404 /\\.(svn|git|hg|bzr|cvs)(/|$)

or

RedirectMatch permanent .*\.(svn|git|hg|bzr|cvs)/.* /

something like this is necessary

RedirectMatch 404 "(?i)/\.?(cvs|svn|git|hg|bzr)"

to really block everything, because

  • CVS directories are uppercase; and
  • don't start with a dot (.) in front.

I hope that helps.

user_67675290

In .htaccess on your server config file.

(1) 

RewriteEngine on
RewriteRule "^(.*/)?\.git/" - [F,L]

And (2)

RedirectMatch 404 /\.git

Place this both method in .htaccess file.

It hides any file or directory whose name begins with .git Like .git directory or .gitignore file by returning a 404.

user_47237500

Create a access rights file in your subversion server installation.

e.g if you folder structure is

/svn

/svn/rights/svnauth.conf

create a configuration file and enter the path of that file in your apache subversion configuration file which you would normally find at /etc/httpd/conf.d/subversion.conf

In your svnauth.conf file define the rights as :

access rights for Foo.com

[foo.com:/trunk/source]

dev1=rw

dev2=rw .....

This way you can control the access rights from one single file and at much granular level.

For more information peruse through the svn red book.

user_495500
Related