[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

RE: Question about svnserve and security

From: Don Adams <dadams_at_scisol.com>
Date: 2006-09-18 20:41:39 CEST

Thanks...so what is the general consensus about security? Is svnserve
secure enough to open up port 3690 to the world if we don't care about
the data being encrypted?

-----Original Message-----
From: Karl Fogel [mailto:kfogel@google.com]
Sent: Monday, September 18, 2006 2:06 PM
To: Garrett Rooney
Cc: Don Adams; users@subversion.tigris.org
Subject: Re: Question about svnserve and security

"Garrett Rooney" <rooneg@electricjellyfish.net> writes:
> On 9/18/06, Don Adams <dadams@scisol.com> wrote:
>> Hello all...I was hoping somebody could answer this question. I can't

>> seem to find a definitive answer. How secure is the custon protocol
>> svnserve? I know it uses CRAM-MD5 so the password never goes out on
>> the wire in the clear, and it seems that many, or most people use it
>> with SSH to provide an encrypted tunnel. What we want to do is just
>> open up the port for svnserve and NOT use SSH. We do not care if the
>> data is encrypted or not, we do care if the password goes over the
wire though.
>
> svnserve uses CRAM-MD5 authentication, so the password itself never
> goes over the wire, just an md5 hash of it.

Technically, an md5 hash of the plaintext password plus some random
salt, I believe, so that it's a different hash every time. You probably
both knew this, I just wanted to clarify for onlookers, because the salt
makes a big security difference.

-Karl

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Received on Mon Sep 18 20:42:27 2006

This is an archived mail posted to the Subversion Users mailing list.