First, upgrade from version 1.3. I recognize that "professional grade"
Linux distributions consider software stability critical, but
Subversion is still significantly evolving, and the number of
important upgrades since version 1.3 is quite large. In particular,
working copies that are checked out with tools like contemporary
TortoiseSVN are 1.6 based, and are not manageable with Subversion 1.3
command line tools.
Second: throw HTTPS based access the heck out. It has always presented
a security issue because the UNIX and Linux Subversion client stores
passwords in clear text, no matter which protocol you use. Use ssh+svn
if you need protected access, with SSH keys managed to a specific
Subversion user account and the stored public keys tweaked to register
specific usernames.
That will probably leapfog you right past this problem.
On Wed, Jun 30, 2010 at 10:42 PM, west alto <westalto_at_gmail.com> wrote:
> Hi Gurus,
>
> Kindly help me with my problem.
>
> Subversion is running fine for sometime and then system load suddenly
> goes high and no one can login to the server.
>
> 172.23.14.1 - - [01/Jul/2010:10:18:36 +0800] "PROPFIND
> /xyz/branches/prod HTTP/1.1" 401 1263
> 172.23.14.1 - - [01/Jul/2010:10:18:36 +0800] "PROPFIND
> /xyz/branches/prod HTTP/1.1" 401 1263
> 172.23.14.1 - - [01/Jul/2010:10:18:36 +0800] "PROPFIND
> /xyz/branches/prod HTTP/1.1" 401 1263
> 172.23.14.1 - - [01/Jul/2010:10:18:37 +0800] "PROPFIND
> /xyz/branches/prod HTTP/1.1" 401 1263
> 172.23.14.1 - - [01/Jul/2010:10:18:37 +0800] "PROPFIND
> /xyz/branches/prod HTTP/1.1" 401 1263
> 172.23.14.1 - - [01/Jul/2010:10:18:37 +0800] "PROPFIND
> /xyz/branches/prod HTTP/1.1" 401 1263
>
>
> Here my spec:
>
> svn 1.3
> apache 2.2
> sles10 sp3
> authenticates with windows ad
>
> - clients are mostly tortoise (1.5 to 1.6) but there use are very
> basic: checkin, checkout, copy, mv, update
> - 90 repositories hosted
> - one hudson client running every 30 mins which connects to 50+ repositories
>
> every repository are defined this way in apache:
>
> <Location /abc>
> DAV svn
> SVNPath /srv/svn/abc
>
> AuthName "Please use your ACTIVE DIRECTORY for Authentication"
> AuthType Basic
> AuthBasicProvider ldap
> AuthzLDAPAuthoritative off
> Include /etc/apache2/.ldapbinddn
> AuthLDAPURL "ldaps://192.168.1.1
> 192.168.1.2:636/OU=ADBC,DC=def,DC=local?sAMAccountName?sub?(objectClass=user)"
>
> SSLRequireSSL
> AuthzSVNAccessFile /etc/apache2/svn_acl/abc
> Require valid-user
> SVNPathAuthz off
> </Location>
>
>
> mod_ldap setting:
>
> LDAPTrustedMode SSL
> LDAPVerifyServerCert off
> LDAPSharedCacheSize 500000
> LDAPCacheEntries 1024
> LDAPCacheTTL 43200
> LDAPOpCacheEntries 1024
> LDAPOpCacheTTL 43200
> LDAPConnectionTimeout 3
>
>
> sysctl.conf:
>
> net.ipv4.icmp_echo_ignore_broadcasts = 1
> net.ipv4.conf.all.rp_filter = 1
> net.ipv4.ip_forward = 1
> net.ipv4.tcp_syncookies = 1
> net.core.rmem_max = 16777216
> net.core.wmem_max = 16777216
> net.ipv4.tcp_rmem = 4096 87380 16777216
> net.ipv4.tcp_wmem = 4096 65536 16777216
> net.ipv4.tcp_window_scaling = 1
> net.ipv4.tcp_timestamps = 1
> net.ipv4.tcp_sack = 1
> net.ipv4.tcp_no_metrics_save = 1
> net.ipv4.tcp_moderate_rcvbuf = 1
> net.core.netdev_max_backlog = 2500
>
> I saw this in my logs:
>
> [Wed Jun 30 18:14:13 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 18:14:23 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 18:56:17 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 18:56:22 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 19:01:07 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 19:01:10 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 19:06:43 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 19:06:48 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 19:12:15 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 19:12:25 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 19:12:37 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 19:13:12 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 19:15:38 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 19:18:24 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 19:18:44 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
> [Wed Jun 30 19:20:27 2010] [error] [client 172.23.139.251] The
> requested report is unknown. [501, #200007]
>
>
> Thanks,
>
>
> West
>
Received on 2010-07-01 14:07:57 CEST