[6ff0105] | 1 | <?xml version="1.0" encoding="ISO-8859-1"?>
|
---|
[6732c094] | 2 | <!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
|
---|
| 3 | "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
|
---|
[6ff0105] | 4 | <!ENTITY % general-entities SYSTEM "../../general.ent">
|
---|
| 5 | %general-entities;
|
---|
| 6 | ]>
|
---|
| 7 |
|
---|
| 8 | <sect1 id="svnserver" xreflabel="Running a Subversion Server">
|
---|
[eae0107f] | 9 | <?dbhtml filename="svnserver.html"?>
|
---|
| 10 |
|
---|
| 11 | <sect1info>
|
---|
| 12 | <othername>$LastChangedBy$</othername>
|
---|
| 13 | <date>$Date$</date>
|
---|
| 14 | </sect1info>
|
---|
| 15 |
|
---|
| 16 | <title>Running a Subversion Server</title>
|
---|
| 17 |
|
---|
| 18 | <sect2 role="package">
|
---|
| 19 | <title>Running a Subversion Server</title>
|
---|
| 20 |
|
---|
| 21 | <para>This section will describe how to set up, administer and secure
|
---|
| 22 | a <application>Subversion</application> server.</para>
|
---|
| 23 |
|
---|
[84f9b731] | 24 | <!-- <note>
|
---|
[cf5c43f3] | 25 | <para>The default build instructions for
|
---|
| 26 | <application>Subversion</application> disabled the
|
---|
| 27 | <application>Berkeley DB</application> repository back-end due to the
|
---|
| 28 | errors encountered in the test suite while building the
|
---|
| 29 | <xref linkend="subversion"/> package. This should not present a
|
---|
| 30 | functionality issue as the FSFS repository back-end is now the default,
|
---|
| 31 | and recommended by the <application>Subversion</application> development
|
---|
| 32 | team.</para>
|
---|
| 33 |
|
---|
| 34 | <para>If you have existing repositories based on a
|
---|
| 35 | <application>Berkeley DB</application> back-end and you followed the
|
---|
| 36 | BLFS instructions for building <application>Subversion</application>,
|
---|
| 37 | you'll need to dump the databases, create new repositories using the
|
---|
| 38 | FSFS back-end, then then reload the data into the new repositories.
|
---|
| 39 | Instructions for performing these operations can be found at <ulink
|
---|
| 40 | url="http://svnbook.red-bean.com/en/1.1/ch05s03.html#svn-ch-5-sect-3.5"/>.
|
---|
| 41 | </para>
|
---|
[84f9b731] | 42 | </note> -->
|
---|
[cf5c43f3] | 43 |
|
---|
[eae0107f] | 44 | <bridgehead renderas="sect3">Subversion Server Dependencies</bridgehead>
|
---|
| 45 |
|
---|
| 46 | <bridgehead renderas="sect4">Required</bridgehead>
|
---|
| 47 | <para><xref linkend="subversion"/> and
|
---|
| 48 | <xref linkend="openssh"/></para>
|
---|
| 49 |
|
---|
| 50 | </sect2>
|
---|
| 51 |
|
---|
| 52 | <sect2 role="configuration">
|
---|
| 53 | <title>Setting up a Subversion Server.</title>
|
---|
| 54 |
|
---|
| 55 | <para>The following instructions will install a
|
---|
| 56 | <application>Subversion</application> server, which will be set up
|
---|
| 57 | to use <application>OpenSSH</application> as the secure remote access
|
---|
| 58 | method, with <command>svnserve</command> available for anonymous
|
---|
| 59 | access.</para>
|
---|
| 60 |
|
---|
| 61 | <para>Configuration of the <application>Subversion</application> server
|
---|
| 62 | consists of the following steps:</para>
|
---|
| 63 |
|
---|
| 64 | <sect3>
|
---|
| 65 | <title>1. Setup Users, Groups, and Permissions</title>
|
---|
| 66 |
|
---|
[823b1a3] | 67 | <para>You'll need to be user
|
---|
| 68 | <systemitem class='username'>root</systemitem> for the initial portion of
|
---|
[eae0107f] | 69 | configuration. Create the <systemitem class="username">svn</systemitem>
|
---|
| 70 | user and group with the following commands:</para>
|
---|
| 71 |
|
---|
[b785ab29] | 72 | <screen role="root"><userinput>groupadd -g 56 svn &&
|
---|
| 73 | useradd -c "SVN Owner" -d /home/svn -m -g svn -s /bin/false -u 56 svn</userinput></screen>
|
---|
[eae0107f] | 74 |
|
---|
| 75 | <para>If you plan to have multiple repositories, you should have a
|
---|
| 76 | group dedicated to each repository for ease of administration. Create
|
---|
| 77 | the <systemitem class="groupname">svntest</systemitem> group for the test
|
---|
| 78 | repository and add the <systemitem class="username">svn</systemitem>
|
---|
| 79 | user to that group with the following commands:</para>
|
---|
| 80 |
|
---|
[b785ab29] | 81 | <screen role="root"><userinput>groupadd -g 57 svntest &&
|
---|
[eae0107f] | 82 | usermod -G svntest svn</userinput></screen>
|
---|
| 83 |
|
---|
| 84 | <para>Additionally you should set <command>umask 002</command> while
|
---|
| 85 | working with a repository so that all new files will be writable by
|
---|
| 86 | owner and group. This is made mandatory by creating a wrapper script for
|
---|
| 87 | <command>svn</command> and <command>svnserve</command>:</para>
|
---|
| 88 |
|
---|
| 89 | <screen role="root"><userinput>mv /usr/bin/svn /usr/bin/svn.orig &&
|
---|
[42c74de] | 90 | mv /usr/bin/svnserve /usr/bin/svnserve.orig &&
|
---|
[eae0107f] | 91 | cat >> /usr/bin/svn << "EOF"
|
---|
| 92 | <literal>#!/bin/sh
|
---|
[42c74de] | 93 | umask 002
|
---|
[eae0107f] | 94 | /usr/bin/svn.orig "$@"</literal>
|
---|
| 95 | EOF
|
---|
| 96 | cat >> /usr/bin/svnserve << "EOF"
|
---|
| 97 | <literal>#!/bin/sh
|
---|
[42c74de] | 98 | umask 002
|
---|
[eae0107f] | 99 | /usr/bin/svnserve.orig "$@"</literal>
|
---|
| 100 | EOF
|
---|
| 101 | chmod 0755 /usr/bin/svn{,serve}</userinput></screen>
|
---|
| 102 |
|
---|
| 103 | <note>
|
---|
| 104 | <para>If you use <application>Apache</application> for working with
|
---|
| 105 | the repository over HTTP, even for anonymous access, you should wrap
|
---|
| 106 | <command>/usr/sbin/httpd</command> in a similar script.</para>
|
---|
| 107 | </note>
|
---|
| 108 |
|
---|
| 109 | </sect3>
|
---|
| 110 |
|
---|
| 111 | <sect3>
|
---|
| 112 | <title>2. Create a Subversion repository.</title>
|
---|
| 113 |
|
---|
| 114 | <para>With subversion-1.1.0 and greater, a new type of repository
|
---|
| 115 | data-store is available, FSFS. There is a tradeoff for speed with
|
---|
| 116 | the new backend, however, the repository can now be placed on a
|
---|
| 117 | network mount, and any corruption does not require an admin to
|
---|
| 118 | recover the repository. For more information and comparison between
|
---|
[bfb7882] | 119 | FSFS and BDB, see <ulink
|
---|
[eae0107f] | 120 | url="http://svnbook.red-bean.com/svnbook-1.1/ch05.html#svn-ch-5-sect-1.2.A"/>.
|
---|
[cf5c43f3] | 121 | </para>
|
---|
[eae0107f] | 122 |
|
---|
| 123 | <para>Create a new <application>Subversion</application> repository with
|
---|
| 124 | the following commands:</para>
|
---|
| 125 |
|
---|
[cf5c43f3] | 126 | <screen role="root"><userinput>install -v -m 0755 -d /srv &&
|
---|
| 127 | install -v -m 0755 -o svn -g svn -d /srv/svn/repositories &&
|
---|
[eae0107f] | 128 | svnadmin create --fs-type fsfs /srv/svn/repositories/svntest</userinput></screen>
|
---|
[42c74de] | 129 |
|
---|
[cf5c43f3] | 130 | <para>Now that the repository is created, it should be populated with
|
---|
[eae0107f] | 131 | with something useful. You'll need to have a predefined directory
|
---|
[cf5c43f3] | 132 | layout set up exactly as you want your repository to look. For
|
---|
[eae0107f] | 133 | example, here is a sample BLFS layout setup with a root of
|
---|
| 134 | <filename>svntest/</filename>. You'll need to setup a directory
|
---|
| 135 | tree similar to the following:</para>
|
---|
[42c74de] | 136 |
|
---|
[eae0107f] | 137 | <screen><literal> svntest/ # The name of the repository
|
---|
[42c74de] | 138 | trunk/ # Contains the existing source tree
|
---|
| 139 | BOOK/
|
---|
| 140 | bootscripts/
|
---|
| 141 | edguide/
|
---|
| 142 | patches/
|
---|
| 143 | scripts/
|
---|
| 144 | branches/ # Needed for additional branches
|
---|
[eae0107f] | 145 | tags/ # Needed for tagging release points</literal></screen>
|
---|
[42c74de] | 146 |
|
---|
[eae0107f] | 147 | <para>Once you've created your directory layout as shown above, you
|
---|
| 148 | are ready to do the initial import:</para>
|
---|
[42c74de] | 149 |
|
---|
[eae0107f] | 150 | <screen role="root"><userinput>svn import -m "Initial import." \
|
---|
[3cb0c57] | 151 | <replaceable></path/to/source/tree></replaceable> \
|
---|
[eae0107f] | 152 | file:///srv/svn/repositories/svntest</userinput></screen>
|
---|
[42c74de] | 153 |
|
---|
[cf5c43f3] | 154 | <para>Now change owner and group information on the
|
---|
[e615d9b] | 155 | repository, and add an unprivileged user to the
|
---|
[eae0107f] | 156 | <systemitem class="groupname">svn</systemitem> and
|
---|
| 157 | <systemitem class="groupname">svntest</systemitem> groups:</para>
|
---|
[42c74de] | 158 |
|
---|
[eae0107f] | 159 | <screen role="root"><userinput>chown -R svn:svntest /srv/svn/repositories/svntest &&
|
---|
[42c74de] | 160 | chmod -R g+w /srv/svn/repositories/svntest &&
|
---|
| 161 | chmod g+s /srv/svn/repositories/svntest/db &&
|
---|
[3cb0c57] | 162 | usermod -G svn,svntest,<replaceable><insert existing groups></replaceable> <replaceable><username></replaceable></userinput></screen>
|
---|
[eae0107f] | 163 |
|
---|
| 164 | <para><systemitem class="groupname">svntest</systemitem> is the group
|
---|
| 165 | assigned to the svntest repository. As mentioned earlier, this eases
|
---|
| 166 | administration of multiple repositories when using
|
---|
| 167 | <application>OpenSSH</application> for authentication. Going forward,
|
---|
[4c288b0] | 168 | you'll need to add your unprivileged user, and any additional users that
|
---|
[eae0107f] | 169 | you wish to have write access to the repository, to the
|
---|
| 170 | <systemitem class="groupname">svn</systemitem> and
|
---|
| 171 | <systemitem class="groupname">svntest</systemitem> groups.</para>
|
---|
| 172 |
|
---|
| 173 | <para>In addition, you'll notice that the new repository's
|
---|
| 174 | <filename>db</filename> directory is set-groupID. If the reasoning is
|
---|
| 175 | not immediately obvious, when using any external authentication method
|
---|
| 176 | (such as <command>ssh</command>), the sticky bit is set so that all
|
---|
| 177 | new files will be owned by the user, but group of
|
---|
| 178 | <systemitem class="groupname">svntest</systemitem>. Anyone in the
|
---|
| 179 | <systemitem class="groupname">svntest</systemitem> group can create
|
---|
| 180 | files, but still give the entire group write access to those
|
---|
| 181 | files. This avoids locking out other users from the repository.</para>
|
---|
| 182 |
|
---|
[cf5c43f3] | 183 | <para>Now, return to an unprivileged user account, and take a
|
---|
| 184 | look at the new repository using <command>svnlook</command>:</para>
|
---|
[eae0107f] | 185 |
|
---|
| 186 | <screen><userinput>svnlook tree /srv/svn/repositories/svntest/</userinput></screen>
|
---|
| 187 |
|
---|
| 188 | <note>
|
---|
| 189 | <para>You may need to log out and back in again to refresh your group
|
---|
[3cb0c57] | 190 | memberships. '<command>su <replaceable><username></replaceable></command>'
|
---|
[eae0107f] | 191 | should work around this as well.</para>
|
---|
| 192 | </note>
|
---|
| 193 |
|
---|
| 194 | </sect3>
|
---|
| 195 |
|
---|
| 196 | <sect3>
|
---|
| 197 | <title>3. Configure the Server</title>
|
---|
| 198 |
|
---|
| 199 | <para>As mentioned previously, these instructions will configure the
|
---|
| 200 | server to use only <command>ssh</command> for write access to the
|
---|
| 201 | repository and to provide anonymous access using
|
---|
| 202 | <command>svnserve</command>. There are several other ways to provide
|
---|
| 203 | access to the repository. These additional configurations are best
|
---|
| 204 | explained at <ulink url="http://svnbook.red-bean.com/"/>.</para>
|
---|
| 205 |
|
---|
| 206 | <para>Access configuration needs to be done for each repository.
|
---|
| 207 | Create the <filename>svnserve.conf</filename> file for the svntest
|
---|
| 208 | repository using the following commands:</para>
|
---|
| 209 |
|
---|
| 210 | <screen role="root"><userinput>cp /srv/svn/repositories/svntest/conf/svnserve.conf \
|
---|
| 211 | /srv/svn/repositories/svntest/conf/svnserve.conf.default &&
|
---|
| 212 | cat > /srv/svn/repositories/svntest/conf/svnserve.conf << "EOF"
|
---|
| 213 | <literal>[general]
|
---|
| 214 | anon-access = read
|
---|
| 215 | auth-access = write</literal>
|
---|
| 216 | EOF</userinput></screen>
|
---|
[42c74de] | 217 |
|
---|
[eae0107f] | 218 | <para>There is not a lot to the configuration file at all. You'll
|
---|
| 219 | notice that only the general section is required. Take a look at the
|
---|
| 220 | <filename>svnserve.conf.default</filename> file for information on using
|
---|
| 221 | <command>svnserve</command>'s built-in authentication method.</para>
|
---|
[42c74de] | 222 |
|
---|
[eae0107f] | 223 | </sect3>
|
---|
[42c74de] | 224 |
|
---|
[eae0107f] | 225 | <sect3 id="svnserver-init">
|
---|
| 226 | <title>4. Starting the Server</title>
|
---|
[42c74de] | 227 |
|
---|
[eae0107f] | 228 | <para>There are a couple of ways to start <command>svnserve</command>.
|
---|
| 229 | The most common way is to start it as an <command>inetd</command> or
|
---|
| 230 | <command>xinetd</command> process. Alternately, you can use a
|
---|
| 231 | bootscript to start the service at startup.</para>
|
---|
[42c74de] | 232 |
|
---|
[eae0107f] | 233 | <note>
|
---|
| 234 | <para>If you do not wish to provide anonymous access to your svn
|
---|
| 235 | repositories or use <command>svnserve</command>'s built-in
|
---|
| 236 | authentication, you do not need to run
|
---|
| 237 | <command>svnserve</command>.</para>
|
---|
| 238 | </note>
|
---|
[42c74de] | 239 |
|
---|
[eae0107f] | 240 | <para>If you use <command>inetd</command>, add a line to
|
---|
| 241 | <filename>/etc/inetd.conf</filename> using the following
|
---|
| 242 | commands:</para>
|
---|
[42c74de] | 243 |
|
---|
[eae0107f] | 244 | <indexterm zone="svnserver svnserver-init">
|
---|
| 245 | <primary sortas="e-etc-inetd.conf">/etc/inetd.conf</primary>
|
---|
| 246 | </indexterm>
|
---|
[42c74de] | 247 |
|
---|
[eae0107f] | 248 | <screen role="root"><userinput>cat >> /etc/inetd.conf << "EOF"
|
---|
| 249 | <literal>svn stream tcp nowait svn /usr/bin/svnserve svnserve -i</literal>
|
---|
| 250 | EOF</userinput></screen>
|
---|
[7afc6e2] | 251 |
|
---|
[eae0107f] | 252 | <para>If you use <command>xinetd</command>, the following command will
|
---|
| 253 | create the <application>Subversion</application> server file as
|
---|
| 254 | <filename>/etc/xinetd.d/svn</filename>:</para>
|
---|
[42c74de] | 255 |
|
---|
[eae0107f] | 256 | <indexterm zone="svnserver svnserver-init ">
|
---|
| 257 | <primary sortas="e-etc-xinetd.d-svn">/etc/xinetd.d/svn</primary>
|
---|
| 258 | </indexterm>
|
---|
[42c74de] | 259 |
|
---|
[eae0107f] | 260 | <screen role="root"><userinput>cat >> /etc/xinetd.d/svn << "EOF"
|
---|
| 261 | <literal># Begin /etc/xinetd.d/svn
|
---|
[42c74de] | 262 |
|
---|
| 263 | service svn
|
---|
| 264 | {
|
---|
| 265 | port = 3690
|
---|
| 266 | socket_type = stream
|
---|
| 267 | protocol = tcp
|
---|
| 268 | wait = no
|
---|
| 269 | user = svn
|
---|
| 270 | server = /usr/bin/svnserve
|
---|
| 271 | server_args = -i -r /srv/svn/repositories
|
---|
| 272 | }
|
---|
[1f672c1] | 273 |
|
---|
[eae0107f] | 274 | # End /etc/xinetd.d/svn</literal>
|
---|
| 275 | EOF</userinput></screen>
|
---|
[42c74de] | 276 |
|
---|
[cf5c43f3] | 277 | <para>Finally, if you wish to simply start the server at
|
---|
[eae0107f] | 278 | startup, install the svn bootscript included in the
|
---|
[5254d12] | 279 | <xref linkend="bootscripts"/> package.</para>
|
---|
[42c74de] | 280 |
|
---|
[eae0107f] | 281 | <indexterm zone="svnserver svnserver-init">
|
---|
| 282 | <primary sortas="f-svn">svn</primary>
|
---|
| 283 | </indexterm>
|
---|
[42c74de] | 284 |
|
---|
[eae0107f] | 285 | <screen role="root"><userinput>make install-svn</userinput></screen>
|
---|
[6ff0105] | 286 |
|
---|
[eae0107f] | 287 | </sect3>
|
---|
[6ff0105] | 288 |
|
---|
[eae0107f] | 289 | </sect2>
|
---|
[6ff0105] | 290 |
|
---|
[eae0107f] | 291 | </sect1>
|
---|