Topics

Configure `mod_dav_svn` to provide a list of available Subversion repositories

Content

1 Objective
2 Scenario
3 Method
4 Security Considerations
5 Note

Tested on

Debian (Lenny, Squeeze)

Ubuntu (Lucid)

Objective

To configure the mod_dav_svn Apache module to provide a list of available Subversion repositories

Scenario

Suppose that there are a number of Subversion repositories located in the directory /var/lib/svn. You have instructed Apache to serve these via HTTP by means of the following configuration:

<Location /svn>
 DAV svn
 SVNParentPath /var/lib/svn
</Location>

(SVNParentPath serves all repositories within a given directory, whereas SVNPath serves a single repository. The method described here is only applicable if you are using SVNParentPath.)

Although this makes the repositories accessible, they are only usable if you know what they are called: in its default configuration, mod_dav_svn does provide a list of the repositories that are available. You wish to override this behaviour and provide an index page.

Method

An index page can be provided by setting the SVNListParentPath directive to On:

<Location /svn>
 DAV svn
 SVNParentPath /var/lib/svn
 SVNListParentPath On
</Location>

Security Considerations

SVNListParentPath is disabled by default on the grounds that providing an index can be a security issue under some circumstances:

You may not want your users to be aware of what other repositories are available.
Your users may already know what repositories are available, but you want to minimise the amount of information available to an intruder.

However it should also be said that having an index can significantly improve usability, and the author’s advice would be to enable SVNListParentPath unless you have a specific reason not to.

If you restrict read access to your repositories then you should consider whether you want the same restrictions to apply to the index page and (if so) check that they do.

Note

All subdirectories within the directory specified by SVNParentPath are presumed to be Subversion repositories. mod_dav_svn makes no attempt to determine whether this is actually the case.

Tags: svn