Khawulela umsingathi we-Subversion kubasebenzisi be-VPN nge-Apache 2.4

Ukuqondisa umsingathi wengqondo we-Subversion ekhelini le-VPN kushintsha ukuthi iyiphi isayithi ephendula isicelo, hhayi ukuthi ubani ogunyaziwe ukusithumela. Ukuhlolwa kokufinyelela kwenzeka kamuva, ngokwemithetho esigabeni esihambisana ne-URL, futhi igama lomsingathi alilokothi lingene kuleso sinqumo. Uma i-ServerName bekuwukuphela koshintsho lwakho, isitoreji sifinyeleleka ngendlela efanayo nayizolo. Imibuzo emibili ehlukene kufanele iphendulwe ekulungiseleleni: iyiphi i-socket eyamukele ukuxhumana nokuthi isicelo sasiphethe ubuphi ubunikazi.

I-ServerName inquma ini ngempela

Ukusingathwa kwengqondo okususelwa egameni kuqhathanisa isihloko se-Host namarekhodi e-ServerName ne-ServerAlias, kukhetha umsingathi oyedwa bese kuvumela ukuthi asingathe isicelo. Ukuxhumana ngokwako kwamukelwa ngaphambili yi-socket ye-Listen engokomlindi, hhayi eyomsingathi. Yingakho igama elibonakala liyimfihlo linganikezi kuvikelwa: noma yimuphi umthengi ofinyelela ku-socket angathumela leso sihloko se-Host. Igama liwukhiye wokuhambisa, futhi okhiye bokuhambisa bakhethwa yilowo obizayo.

Ungabona imephu ngaphandle kokuqagela. I-apachectl -S iphrinta umsingathi ngamunye, imbobo yakhe namagama akhe, futhi imaka ukuthi yimuphi ojwayelekile kuleli kheli.

I-RequireAll iyisiqukathi esenza kokubili ukuhlolwa kube yimpoqo

I-Apache 2.4 igoqa imiyalelo ye-Require yesigaba esisodwa ku-RequireAny engabonakali, ngakho imiyalelo emibili engenalutho isho ukuthi eyodwa yazo yanele. Engeza isiqukathi futhi incazelo iyaphenduka:

<Location /svn/repo>
    AuthType Basic
    AuthName "Subversion"
    AuthBasicProvider file
    AuthUserFile /etc/apache2/svn.htpasswd
    <RequireAll>
        Require ip 10.8.0.0/24
        Require valid-user
    </RequireAll>
</Location>

I-RequireAll idinga kokubili izimo: ikheli lomthombo ngaphakathi kwebanga lethuneli nomsebenzisi owamukelwa yisitoreji. Yilokho okufanele kusho i-VPN-kuphela ku-URL ye-Subversion. Incwadi yereferensi ye-mod_authz_core ibhala imithetho yesiqukathi. Gcina ibhlokhi ngaphakathi kwe-Location ekhona yesitoreji futhi ushiye imiyalelo ye-DAV esebenzayo endaweni yayo, ngoba lesi siqephu asishintshi i-AuthType noma ifayela lemiphakamo noma ukugunyazwa kwezinga lendlela.

Ukuhlolwa komthombo kuvela ku-mod_authz_host, ngakho qinisekisa ukuthi ilayishiwe ngaphambi kokuxazulula enye into: apachectl -M | grep authz_host.

Ikheli i-Apache elihlola ikheli le-socket

I-Require ip iqhathanisa nekheli i-Apache elirekhode ukuxhumana, futhi lokho akuwona njalo ikheli umthengi acabanga ukuthi unalo.

Uma i-VPN ihambisa amakheli ayo ngaphandle kokuhumusha, i-Apache ibona ikheli lethuneli futhi i-10.8.0.0/24 iyafana. Uma isango lihumusha, i-Apache ibona isango futhi umthetho awuhambisani nalutho ngokuthula; okufanayo kwenzeka ngemuva kwesilinganisi somthwalo esiphetha i-TLS phambi komsingathi. Kuleso simo kukhona i-mod_remoteip. I-RemoteIPHeader X-Forwarded-For kanye ne-RemoteIPTrustedProxy yesilinganisi zishintsha ikheli elirekhodiwe, futhi yilapho kuphela ibanga linokuthile okungaqhathaniswa nakho.

Ukwethemba isihloko sokudlulisa esingafunwa kubi kunokungabi nawo umthetho nhlobo. Noma yimuphi umthengi angathumela i-X-Forwarded-For equkethe i-10.8.0.9 futhi ahlangabezane nokuhlolwa kwebanga elingakaze liboshwe egxathini elithembekile.

Hlela isilaleli kanye nenqubomgomo yesitoreji ngezingqimba

Ukubopha kuwukulawula okwehlukile futhi ngokuvamile okulula. I-Listen 10.8.0.1:443 inquma ukuthi yimaphi ama-socket akhona, futhi isicelo asikwazi ukukhetha umsingathi ku-socket engakaze ivulwe. Inani uhlelo lokuqalisa: uma isixhumi sethuneli siphansi lapho i-Apache iqala, ukubopha kuyahluleka futhi insizakalo ayinyuki. Kuxhumanise nohlelo lwamayunithi, noma bopha ekhelini elikhona ngokuzimela ethunelini.

Izimvume zendlela zihlala ku-AuthzSVNAccessFile. I-akhawunti evumelekile yesayithi ayiyona imvume efanayo nokufinyelela kokubhala endleleni yephrojekthi, futhi umthetho wenethiwekhi awukushintshi lokho.

Qaphela ukuhlanganiswa kwezigaba uma ibhlokhi ikufayela elifakiwe. I-Apache ihlanganisa iziqukathi zokugunyazwa kuzo zonke izigaba ezifakwe ngaphakathi futhi isigaba esihambisana kakhulu singashintsha imfuneko esikhundleni sokungeza kuyo, ngakho umthetho ku-/svn kungenzeka ungafinyeleli ku-/svn/repo/trunk uma isigaba esincane sichaza esaso.

Fakazela kokubili ukwenqaba ngaphambi kokuthi usho ukuthi kuqediwe

Hlola izicelo ezine, hhayi esisodwa. Ngaphakathi kwe-VPN nge-akhawunti evumelekile kufanele uthole uhlu lwesitoreji. Ngaphakathi kwe-VPN ngemiphakamo engalungile kufanele uthole i-401 esikhundleni sohlu. Ngaphandle kwe-VPN ngezinkulumo zokungena ezivumelekile kufanele uthole i-403, futhi isicelo esifanayo somphakathi kunye negama lomsingathi ohlukile kufanele sehluleke ngendlela efanayo.

Umyalo owodwa ngendaba ngayinye wanele: curl -sI -u user:pass https://svn.example.com/svn/repo/, bese ufunda umugqa wesimo. Phinda indaba esebenzayo ngomthengi wangempela futhi, ngoba i-svn info izijwayeza izindlela ze-DAV ezizosetshenziswa ukubhala nokubuyekeza.

Uma noma yimuphi wemiphumela emine ungahambisani nenqubomgomo obuyihlosile, ukulungiselela akukapheli, futhi ukushintsha igama lomsingathi ngeke kukushintshe lokho.