Takaita masaukin Subversion ga masu amfani da VPN da Apache 2.4

Mayar da masaukin kama-da-wane na Subversion zuwa adireshin VPN yana canza wace shafi ce ke amsa buƙata, ba wanda aka yarda ya aika ta ba. Ana yin binciken shiga daga baya, bisa ga ƙa'idojin da ke cikin sashen da ya dace da URL, kuma sunan masauki ba ya taɓa shiga wannan shawarar. Idan ServerName ne kawai canjin da ka yi, ajiyar tana isa kamar jiya. Dole a amsa tambayoyi biyu daban-daban a cikin saitin: wace soket ce ta karɓi haɗin, kuma wace shaida ce buƙatar ta ɗauka.

Abin da ServerName ke yankewa a zahiri

Masaukai kama-da-wane bisa suna suna kwatanta kan Host da shigarwar ServerName da ServerAlias, su zaɓi masauki ɗaya kuma su bar shi ya gudanar da buƙatar. Soket ɗin Listen da ke na uwar garke ne, ba na masaukin ba, ya karɓi haɗin da kansa a baya. Shi ya sa sunan da ya yi kama da na sirri ba ya ba da kariya: duk wani abokin ciniki da ya isa soket ɗin zai iya aika wannan kan Host. Sunan maɓallin turawa ne, kuma mai kira ne ke zaɓar maɓallan turawa.

Kana iya ganin taswirar ba tare da hasashe ba. apachectl -S yana buga kowane masauki, tasharsa da sunayensa, kuma ya nuna wanda ya zama tsoho ga adireshin.

RequireAll shi ne kwandon da ke tilasta duka binciken biyu

Apache 2.4 yana naɗe umarnin Require na sashe ɗaya cikin RequireAny na ɓoye, don haka umarni biyu tsirara suna nufin ɗaya daga cikinsu ya isa. Ƙara kwandon kuma ma'anar ta juya:

<Location /svn/repo>
    AuthType Basic
    AuthName "Subversion"
    AuthBasicProvider file
    AuthUserFile /etc/apache2/svn.htpasswd
    <RequireAll>
        Require ip 10.8.0.0/24
        Require valid-user
    </RequireAll>
</Location>

RequireAll yana buƙatar duka sharuɗɗan biyu: adireshin tushe cikin kewayon rami da mai amfani da ajiyar ta karɓa. Abin da ya kamata VPN-kawai ya nufa ga URL na Subversion ke nan. Bayanin mod_authz_core yana rubuta ƙa'idojin kwandon. Ka ajiye gunkin cikin Location ɗin da ke akwai na ajiyar kuma ka bar umarnin DAV da ke aiki tuni a wurinsu, domin wannan yanki ba ya maye gurbin AuthType ko fayil ɗin kalmar sirri ko izini a matakin hanya.

Binciken tushe ya fito daga mod_authz_host, don haka tabbatar an loda shi kafin ka gyara wani abu: apachectl -M | grep authz_host.

Adireshin da Apache ke kimantawa shi ne adireshin soket

Require ip yana kwatanta da adireshin da Apache ya yi rikodin don haɗin, wanda ba koyaushe ne adireshin da abokin ciniki yake tsammanin yana da shi ba.

Lokacin da VPN ke tura adireshinsa ba tare da fassara ba, Apache yana ganin adireshin ramin kuma 10.8.0.0/24 ya dace. Lokacin da ƙofa ke fassara, Apache yana ganin ƙofar kuma ƙa'idar ba ta dace da kome ba a shiru; haka ma ke faruwa a bayan ma'aunin nauyi da ke ƙare TLS a gaban masaukin. Don wannan yanayin akwai mod_remoteip. RemoteIPHeader X-Forwarded-For tare da RemoteIPTrustedProxy na ma'aunin suna maye gurbin adireshin da aka yi rikodi, sannan kewayon yana da abin kwatantawa.

Yin imani da kan turawa na son rai ya fi muni da rashin ƙa'ida kwata-kwata. Kowace abokin ciniki na iya aika X-Forwarded-For ɗauke da 10.8.0.9 kuma ya cika binciken kewayon da ba a taɓa angashe shi da wani mataki amintacce ba.

Ka yi leɓo da mai sauraro da manufar ajiya

Daurewa wani iko ne daban kuma sau da yawa mafi sauƙi. Listen 10.8.0.1:443 yana yanke wace soket ce za ta wanzu, kuma buƙata ba za ta iya zaɓar masauki a kan soket da ba a taɓa buɗewa ba. Farashin shi ne tsarin farawa: idan maɗaurin ramin a kashe yayin da Apache ke farawa, daurewar ta kasa kuma sabis ɗin ba ya tashi. Ka haɗa shi da tsarin raka'a, ko ka ɗaure zuwa adireshin da ke wanzu ba tare da ramin ba.

Izini na hanya yana zama a AuthzSVNAccessFile. Ingancin asusu na shafin ba daidai yake da izinin rubutu zuwa hanyar aiki ba, kuma ƙa'idar cibiyar sadarwa ba ta canza hakan.

Ka kula da haɗewar sashe lokacin da gunkin ke cikin fayil da aka haɗa. Apache yana haɗa kwandon izini a cikin sassan da ke cikin juna kuma sashen da ya fi dacewa zai iya maye gurbin buƙatar maimakon ƙarawa gareta, don haka ƙa'ida a kan /svn mai yiwuwa ba za ta isa /svn/repo/trunk ba da zarar wani sashe mai kunkuntar ya ayyana nasa.

Ka tabbatar da duka ƙin biyun kafin ka ce an gama

Gwada buƙatu huɗu, ba ɗaya ba. Cikin VPN da asusu mai inganci ya kamata ka sami jerin ajiyar. Cikin VPN da kalmar sirri mara kyau ya kamata ka sami 401 maimakon jeri. Daga wajen VPN da tabbatattun shaidun shiga ya kamata ka sami 403, kuma wannan buƙatar ta jama'a zuwa wani sunan masauki daban dole ta kasa haka.

Umarni ɗaya ga kowane yanayi ya isa: curl -sI -u user:pass https://svn.example.com/svn/repo/, sannan ka karanta layin matsayi. Ka maimaita yanayin da ke aiki ta ainihin abokin ciniki ma, domin svn info yana gwada hanyoyin DAV da commit da sabuntawa za su yi amfani da su.

Idan ɗaya daga cikin sakamakon huɗu bai dace da manufar da ka yi niyya ba, saitin bai cika ba, kuma canza sunan masaukin ba zai canza hakan ba.