112

I installed SVN on a Ubuntu machine and I can't get my head around something.

Whenever I checkout something from the terminal I get this error about saving a non-encrypted password:

-----------------------------------------------------------------------
ATTENTION!  Your password for authentication realm:

   <[...]> Subversion Repository

can only be stored to disk
unencrypted!  You are advised to
configure your system so that
Subversion can store passwords
encrypted, if possible.  See the
documentation for details.

You can avoid future appearances of
this warning by setting the value of
the 'store-plaintext-passwords' option
to either 'yes' or 'no' in
'/home/[...]/.subversion/servers'.
-----------------------------------------------------------------------

I goggled it a bit but I couldn't find anything useful. I found one topic where it said this was a client issue, not a server one, but I'm still not convinced.

It says "configure your system"; what exactly does it mean by that? The server or the client? If I'm the server, is there anything I can do about it? besides hiding the warning (like it says)...

Thanks!

treznik
  • 7,955
  • 13
  • 47
  • 59
  • 1
    Possible duplicate of [How to remove warning about storing unencrypted password after commiting file in svn](http://stackoverflow.com/questions/6606782/how-to-remove-warning-about-storing-unencrypted-password-after-commiting-file-in) – ian5v Aug 28 '16 at 19:25
  • 2
    That question is about how to hide the warning if you don't want to encrypt the password. This question is about how to configure a system to properly encrypt the password. – outis nihil Dec 15 '16 at 17:14

3 Answers3

44

It is a client issue. It warns you that the credentials used for the different servers are being stored in plain text. You can hide that warning or use an encrypted storage to cache the passwords.

See: http://blogs.collab.net/subversion/2009/07/subversion-16-security-improvements

zb226
  • 9,586
  • 6
  • 49
  • 79
frisco
  • 1,897
  • 2
  • 21
  • 29
  • 14
    The encryption storages featured were GNOME Keyring or Kwallet, but since I'm not using any desktop interface on my server I'm guessing encryption is out of the question. Right? – treznik Sep 29 '10 at 18:50
  • 3
    In the first comment you can see there is an option to use it command line, not sure how it works but seems feasible. – frisco Sep 29 '10 at 19:33
  • 5
    I can't believe svn doesn't provide for hashed pw like htpasswd or similar. – d-_-b Sep 21 '11 at 06:41
  • 19
    @sims Hashing is good if you want to VERIFY correctness of a password. The client is about to SEND the password to the server, so hashing is not enough. You have to store it in a bidirectional way. – Notinlist Oct 03 '11 at 12:24
  • 2
    On the other hand I do not understand this mania about encryption. If the root of the client computer wants to know your SVN password then he is able to sniff it. Real protection can only be achieved if you use your own computer. Setting file permissions correctly is enough. Or use another computer! – Notinlist Oct 03 '11 at 12:27
  • @notinlist, I'm not an encryption expert, but, AFAIK, when you encrypt something using a cryptographic hash function, you store a the hash (AKA digest) of the plaintext. Well, that is one method. But what do I know, ay? http://linux.die.net/man/3/crypt – d-_-b Oct 06 '11 at 15:54
  • @GuruM SVN 1.4 is really outdated, I don't know why you are forced to use it, but you should try to update at least to 1.6 if not 1.7. – frisco Feb 14 '12 at 08:24
  • 6
    You can get it without recompiling, based on http://ubuntuforums.org/showthread.php?t=1348567. Just set this to ~/.subversion/config [auth] password-stores = gnome-keyring – fikr4n Apr 29 '12 at 03:21
  • To what do you refer by the word "this" above, BornToCode? – Nathan Basanese Aug 04 '15 at 23:30
  • link no longer working...use this https://web.archive.org/web/20160711054406if_/http://blogs.collab.net/subversion/subversion-16-security-improvements#.V4MySHkRdEY – akhalid7 Feb 08 '21 at 11:42
7

By encrypting the password, you will not be able to achieve non-repudiation (other users could use your hash as you) due to OS file permissions. However, most companies have subversion setup using their domain password or some form of SSO password. By encrypting the password, you would at least mask someone from accessing a users other accounts.

I would still be concerned about the encryption strength. If the subversion password is linked to other important accounts, someone might test the encryption strength to crack the password out.

The best bet is to setup the subversion client to turn off stored passwords and force lazy Dev's to authenticate each time.

Jason Lawrence
  • 95
  • 1
  • 1
  • 16
    Whether the latter proposal is "best" depends on other factors. What if devs, faced with an onerous commit/update process, start using SVN less, and as a result, the granularity of sync'ing with others gets coarser? What if they start jury-rigging ways to store their passwords elsewhere and automating the authentication process insecurely? – LarsH Nov 18 '13 at 16:21
2

I store the credentials on an encrypted disk. (Although, while encfs is mounted the credentials are still plain-text to my account)

$ ls -nl ~/.subversion/
total 20K
-rw-r--r-- 1 1000 1000 4.2K 2009-07-10 13:00 README.txt
lrwxrwxrwx 1 1000 1000   31 2009-10-14 14:31 auth -> ~/crypt/subversion/auth/
-rw-r--r-- 1 1000 1000 5.7K 2009-07-10 13:00 config
-rw-r--r-- 1 1000 1000 3.6K 2009-07-10 13:00 servers

Using git-svn means that I need the credentials much less often, so it may not be too onerous to not save them at all.

bsb
  • 1,847
  • 26
  • 24