Deny access to .svn folders on Apache

Question

We have a rails application in subversion that we deploy with Capistrano but have noticed that we can access the files in '/.svn', which presents a security concern.

I wanted to know what the best way to do this. A few ideas:

• Global Apache configuration to deny access
• Adding .htaccess files in the public folder and all subfolders
• Cap task that changes the permissions

I don't really like the idea of deleting the folders or using svn export, since I would like to keep the 'svn info' around.

Answer 1

I seems to me, Apache conf should be :

<Directory ~ "\.svn">
    Order allow,deny
    Deny from all
</Directory>

Answer 2

In .htaccess on your server config file.

(1)

RewriteEngine on
RewriteRule "^(.*/)?\.git/" - [F,L]

And (2)

RedirectMatch 404 /\.git

Place this both method in .htaccess file.

It hides any file or directory whose name begins with .git Like .git directory or .gitignore file by returning a 404.

Answer 3

Create a access rights file in your subversion server installation.

e.g if you folder structure is

/svn

/svn/rights/svnauth.conf

create a configuration file and enter the path of that file in your apache subversion configuration file which you would normally find at /etc/httpd/conf.d/subversion.conf

In your svnauth.conf file define the rights as :

access rights for Foo.com

[foo.com:/trunk/source]

dev1=rw

dev2=rw .....

This way you can control the access rights from one single file and at much granular level.

For more information peruse through the svn red book.

Answer 4

I would rather deny access to all dot-files (eg: .htaccess, .svn, .xxx, etc.), as they normally don't need to be web-accessible.

Here's the rule to achieve this (until Apache 2.2 included):

<LocationMatch "\/\..*">
    Order allow,deny
    Deny from all
</LocationMatch>

(UPDATE) Or you can use the following (which works in Apache 2.2 and 2.4):

# Deny access to dot-files, as 404 error
# (not giving hint about potential existence to the file)
RedirectMatch 404 ".*\/\..*"

Answer 5

I think Riccardo Galli got it right. Even apache already had .svn setup as forbidden for me, but .svn/entries was certainly available...exposing my svn server, port number, usernames, etc.

I actually figure, why not restrict .git as a preventative measure (say you don't use git yet but may someday at which time you will not be thinking about directory restrictions).

And then I thought, why not restrict everything that should be hidden anyway? Can anyone conceive of a problem with this?

RedirectMatch 404 /\\..*(/.*|$)

I added the '.*' after the initial period - only difference from Riccardo. Seems to 404 .svn, .git, .blah, etc.

Answer 6

One other way to protect the .svn files would be to use a redirect in the Apache config:

RedirectMatch 404 /\\.svn(/|$)

So instead of getting a 403 forbidden (and providing clues to would be attackers) you get a 404, which is what we would expect when randomly typing in paths.