Setting up a jail rooted SVN repository

Preparing The Machine
Adding A New Project
Adding A New Developer


This mini-HOWTO decribes how to set up a jail rooted SVN repository on a POSIX system like GNU/Linux.

Access to the repository is done solely through ssh. The ssh login results in a jail rooted shell per project that allows exactly one command. This provides a high degree of security:

  1. Project developers need to be able to login using normal ssh authentication [It is possible to provide anonymous access for which no password is required, see below.]
  2. After logging in through ssh one can only execute a single command, namely svnserve -t, which is needed to access the SVN repository. There is absolutely no room to exploit anything (else) here.
  3. svnserve runs in a jail root with only access to the SVN repository, effectively disabling the possibility to exploit a possible bug in svn. Anonymous users do not have significant write access to this file system.

Preparing the machine

This paragraph describes things that need to be done once per machine.

Adding a new project

We use a new svn repository (and jail root) per project. To add a new project/repository execute the following commands. The prompt $ is omitted for your copy&paste pleasure. Bold commands should be executed as root.

Make sure that the environment variables are ALSO set while being root if you use su instead of sudo!

After adding yourself as developer, you can now go ahead and add the initial directories.

For example,

$ cd $HOME/projects/$PROJECT
$ mkdir tmp
$ cd tmp
$ mkdir branches tags trunk
$ svn import -m 'Initial directory structure' "svn+ssh://$PROJECT/repos"
$ cd ..
$ rm -rf tmp

Or, if you have a dumpfile, for example one that you created from your CVS repository as described here, you could do instead:

$ sudo svnadmin load $SVNBASE/$PROJECT/root/repos < svndump

Finally, check-out your new repository!

$ svn checkout "svn+ssh://$PROJECT/repos/trunk" "$PROJECT"
$ cd "$PROJECT"

From there it should all be known, or go read the svn book.

Adding a new developer

The only thing needed for new developers is to add a (project specific) account for them and add them to the right groups to get write access to the repository.

That's all!