Re: Is the svn:// protocol secure when encrypted via SASL?

"Keith Palmer Jr." <keith_at_consolibyte.com> writes:

> So there's no one out there that knows whether SASL encrypts the data
> stream, or just the authentication (or which SASL modules encrypt the
> data, and which don't)?

That depends on how you have configured your repository via
svnserve.conf:

[sasl]
### This option specifies whether you want to use the Cyrus SASL
### library for authentication. Default is false.
### This section will be ignored if svnserve is not built with Cyrus
### SASL support; to check, run 'svnserve --version' and look for a line
### reading 'Cyrus SASL authentication is available.'
#use-sasl = true
### These options specify the desired strength of the security layer
### that you want SASL to provide. 0 means no encryption, 1 means
### integrity-checking only, values larger than 1 are correlated
### to the effective key length for encryption (e.g. 128 means 128-bit
### encryption). The values below are the defaults.
# min-encryption = 0
# max-encryption = 256

-- 
Philip