LinuxQuestions.org - SVN Setup & User Permissions

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - SVN Setup & User Permissions (https://www.linuxquestions.org/questions/linux-security-4/svn-setup-and-user-permissions-389525/)

SVN Setup & User Permissions

I develop open source software, and I have recently set up an SVN repository for my project. I want to start to allow users other than myself to commit changes to the repository, but I don't want just anyone getting access to my server. I realize that a basic user account won't be able to edit files, but I don't want them to even be able to browse any files other than their home directory and the repository. My ideal solution would be that when a user ssh's into my server, they are sitting in their home directory and there is a symbolic link to the repository.

What I've already done is:

I've set up svn to work through Apache (no svn+ssh required).
I've created an svn group and granted it rw permissions on my repository.

Then I created a user in the svn group like this:

adduser --ingroup svn somedevelopername

I ssh'd to my server and logged in as somedevelopername. I was sitting in my home directory, and I could still browse all over the machine. How can I stop that?

I'm on Debian Sarge.

Thanks in advance for any help you can provide.

Now that I think of it, an even better solution would be to just not grant my developers ssh access to my server. Make them apply all changes through svn. How can I create a user and not allow him/her to ssh into my server?

Quote:

Originally Posted by navvywavvy

You have a couple different options here.
1. You can restrict users via /etc/ssh/sshd_config

Code:

# grep /etc/ssh/sshd_config | AllowUser

AllowUsers navvywavvy gnubie

2. Restrict SSH to public key authentication only

3. Firewall SSH

Code:

yourip="10.0.0.2"



iptables -P INPUT DROP

iptables -A INPUT -i eth0 -p tcp -s $yourip --dport 22 -j ACCEPT

Awesome. I went with option #1 and it worked like a charm.
Thanks!