Setup Collabnet Subversion Edge Server using an existing SVN repository and using LDAP to Authenticate against Windows Domain.

Recently had to setup an SVN server, this svn server was to house an existing svn repository housed on another server. The authentication on this server was setup with the file method.

As part of the move we wanted to utilise the domain resources as we tried to consolidate user management across our applications.

So we chose the latest version of Collabnets Subversion Edge Server 3.2.2 (x64) to run on a Windows 2008 R2 server.

The R2 server was a clean server, with no IIS installed, therefore the setup of apache, which subversion edge relies upon would be less of a pain (no port changes ).

OK, so we ran the installer for Subversion Edge, which was painless, it detected that Java was not installed on the server and it installed Java. It then installed the Subversion Edge server product.

On completion of installation we just left the tick boxes checked that fired up administration portal. By default this will be http://localhost:3343/, the default login is admin with password admin (this can be easily changed).

The repository itself was just copied over from the source server (running svn 1.5), into a folder on the new server using windows explorer. Nothing fancy, no svn dumps etc…

Once logged in you are presented a simple interface, with the status of the apache server given right in the centre. If it is stopped, there is a start button and vice versa.

Under configuration on the right, I went into server settings and added the location of the svn repositories and dump folders. I changed the repository setting to match the location we moved the repository into and the dump folder

D:\SVN\Repositories

D:\SVN\Dumps

I saved these settings, and then went to Repositories, which is on the menu at the top of the page. Here I clicked discover and the repository I copied over appeared in the list.

Ok, so by default you should now have anonymous access to the repository, this is a good spot to check things are working as expected. You can get to the repository from other machines.

Subversion Edge Server runs apache, and it uses http protocol for the client server connection protocol. It does not setup svnserve.exe (although this executable is installed in the csvn folder and can be configured if you want), which means that the svn:// URLs cannot be used in a standard setup, you will therefor be using http URLs. In the repository list, mentioned above, it gives you an example svn client checkout command, which includes the http URL to the repository. The command will look something like below.

svn checkout http://<hostname.domain>/svn/<SVN_REPOSITORY_NAME> <Physical Folder Name to checkout into> --username=admin

This initial process was pretty painless as far as I was concerned, now we came to the LDAP setup. I have only had to use LDAP very sparsely in the past so terminology was vaguely familiar but I found the documentation very limited, in helping you understand what to put into each of the boxes on the authentication page.

So lets go to the authentication page (under configuration menu header on the administration section, in the admin portal )

Now it has to be said, I am far from an expert in any of this, and if you need to add encrypted connectivity to the LDAP – Domain communications then you will have to find that on your own, for our purpose unencrypted comms is fine.

So I will go through each of the settings on that page and try to explain my understanding. Following that I will list out the settings I used (with something's changed for security :o) )

Anonymous Access: Allow read access to anonymous users.

Ok, pretty self explanatory if you want to allow anonymous users to be able to read the repository then check this.

Convert Usernames to Lower Case: Convert usernames to lower case for access rules.

Now I believe that this is good for when you want to start apply rules to control repository access. I have this checked.

Authentication Methods: Local authentication against an htpasswd file along with other providers.
Authentication Methods: LDAP authentication against an LDAP server:

So again, pretty straight forward, first one is to use the old method and a local file. second option is to use LDAP. You can use both, and I think it checks the file and then LDAP. In our case I just want LDAP so htpasswd is unchecked.

LDAP Security Level: None

Ok, now this can be changed to secure the LDAP comms from client to server, I didnot set this so I can’t tell you what needs to be done.

LDAP Server Host: <domain>

So here we come to some juicy bits, now here you can specify one dc directly, and if you do that it will affect the port you use (next option). However assuming you have a modern windows domain with multiple DCs then you probably just want to set this to the domain, so it can use any dc running LDAP.

i.e. if your fully qualified server name was something like server1.domain.com, then you would place domain.com in this setting.

LDAP Server Port: 3268

Hint: try 3268 for Active Directory servers

OK, I think initially this was set to 389 port, which is the correct setting if you want to just use a single LDAP server (see LDAP server Host above). However if you want to utilise the functionality of any of the dcs in the domain then set this to 3268.

LDAP Base DN: CN=Users,DC=domain,DC=com

Example: OU=Users,DC=xxx,DC=yyy,DC=domain,DC=com

Now this setting will depend on how you have your Active directory configured. But a default AD setup will have Users in an CN called Users. What we are setting here is the location subversion Edge will query when looking for users.

A good tool to get DNs (Distinguished Names) from your active directory is ADSIEdit (comes with windows). You can browse to the item, right click properties on it and then look for Distingusihed Name, you can then copy it out.

LDAP Bind DN: CN=<svnLDAPQueryUserName>,CN=Users,DC=domain,DC=com

Now this setting is specifying the user that Subversion will impersonate when sending the query to the LDAP server. Now you can setup a specific user for this purpose and assign the necessary rights to the user to query the directory, so we don’t have to use some form of administrative account. So in Active Directory create the user and password that you want to use for this purpose. Now on the OU you want to query (in the default case this will be Users), right click the client and select Delegate Control, this will start a wizard.

In this wizard select the user/groups you want to delegate to, then in delegate the following common tasks select “Read All User Information”. This will allow us to use this user.

LDAP Bind Password: <password>

BindDN and Password are only needed if anonymous binding is not supported.

Password of the user we created above. :o)

LDAP Login Attribute: samAccountName

The default attribute is 'uid'. Hint: use samAccountName for Active Directory

Set this to samAccountname to ensure that Subversion is loking for the usernames in the correct attributes.

LDAP Search Scope: Sub

Now this will tie in with the LDAP Base DN setting earlier. we are just telling subversion whether to recurse through sub OUs or stay in the OU.

LDAP Filter: objectClass=user

As we will be authenticating user, it makes sense to try and speed up the searching by starting we are looking for users so thats what we do here.

LDAP Server Certificate Verification: <checked>

Verify the certificate of the LDAP server.

I am afraid I don’t know what this does, but I left it checked.

Console LDAP Authentication: <unchecked>

Allow LDAP users to access the management console

Now I unchecked this, to stop them trying to access the admin console (it will allow them a limited set of usability to browse the repository in a web page). This is up to you but for me this was not needed, the developers use tortoisesvn which has a browser.

Console LDAP Authentication Helper Port: 49156

Used to facilitate LDAP authentication to the console with the above settings. Normally, no change is needed here.

Left this one as default. 49156, not sure what it does…. :o)

Ok, and that was it. Saved these settings and then tried to use a windows account. And for me this worked. You don’t need to specify a domain, with the username just the username.

OK, that was it, but in this current setup any user that can authenticate to the windows domain could access the repository and potentially reek havoc.. ;o)

So how to limit access… This is achieved by changing the access rules in the subversion Edge admin portal.

By default the access rules section, found under the repositories top menu item, will be set to

[/]
* = rw

This is telling subversion that everything from the root level down ([/]), is available to all (*) with read and write access (rw)

Ok, so lets remove access to everyone

[/] 
* = 

OK, so now lets add access to our repository

[SVN_REPOSITORY_NAME:/]
windowsusername1=rw
windowsusername2=rw
windowsusername3=r

So here we are saying these rules apply just to our repository at the root level[SVN_REPOSITORY_NAME:/]. You can add more granular control to subsections of the repository by specifying headers like

[SVN_REPOSITORY_NAME:/subsection1/]. 

But in our case we apply at the root level and everything inherits down. Then we are listing the windows usernames with the access we want. user1 and user2 have read access, whilst user3 has only read access.

And that's all folks…. I hope….

Setup Collabnet Subversion Edge Server using an existing SVN repository and using LDAP to Authenticate against Windows Domain.

Part 4 – CentOS SSH – Secure Shelling

SSH – Secure Shelling

Now being a windows guy my method of remoting to another machine was RDPing to it. This gave me a machine desktop on a remote machine. I wanted something similar for CentOS, I found VNC however in finding that I also found SSH. So before delving into how to configure VNC, I want to go into SSH a little. Then in my VNC part of the series I will use SSH to configure VNC.

So what is SSH, SSH is similar to telnet however SSH is encrypted where as telnet is not. By default SSH is installed and is running on the CentOS box. If you followed my previous postings on installation then this should be the case. SSH on CentOS is looked after by a daemon called sshd.

So what do we need to connect via SSH to the CentOS box. I connect from a windows machine so found a client called Puttytray (http://haanstra.eu/putty/). It is based on a client called Putty. There is no install it is just an executable.

Run up the client.

SSH usually runs over port 22. Enter the machine IP you want to connect to, ensure connection type is SSH. Now you can also type in a session name and save it, this will allow you to quickly connect in the future. In the screenshot above I have saved 3 sessions for connecting to 3 different CentOS machines.

Note: when you  first connect to a machine you will be prompted like below, this is a warning just telling you that the servers certificate is not in your cache (this is the same as the windows trusted cache). I click yes here, as i don’t want to be prompted each time I connect to the machine.

Once past the certificate warning you should be shown the above window, prompting for a logon name for this example lets use root.

Once you have entered the user and password, you should be presented with a command prompt. This should look like the prompt we saw in the previous part of this series. It has placed you in the users home directory (~, this is actually the physical folder /home/<username>). The # indicates you are logged in as root, a normal user is presented with a $.

That is pretty much it, what we have now is a remote command line terminal. So in the next part I will use this remote SSH connection to configure VNC.

Other parts in this series

• Introduction
• Install CentOS (and initial configuration) for the Windows Sys Admin.
  1. Part 1 - Basic Install
  2. Part 2 - Initial Configuration
  3. Part 3 - Proxy configuration
  4. Part 4 - SSH (Secure shelling)
  5. Part 5 - Setting up VNC Server (inc firewall)
  6. Part 6 - Setup Windows Authentication integration.
  7. Part 7 - Tips
• Online Documentation (all the good articles I have found on the tinterweb).

Part 4 – CentOS SSH – Secure Shelling

Part 3 - CentOS Proxy Configuration

CentOS Proxy Configuration

It took me a while to figure this out, being used to Windows and having IE generally used as a central repository for proxy settings, I was looking for something similar in CentOS. I am afraid in this case, as far as I can make out, proxy settings are mostly application specific. That said I believe there are locations that are apparently meant to be used for central proxy configuration and programs should try to get the proxy info from them. The central locations are split between GUI programs and command line programs.

So in this post I show how to configure the proxy settings in 4 locations, 2 of which are “apparently” central locations for other programs to use and the other 2 are program specific (as they seem to ignore the central settings). The 4 locations are

1. Gnome Proxy (used by GUI programs)
2. Proxy Environment Variables (used by command line programs)
3. YUM (Software updater and installer)
4. Firefox (Web browser)

Gnome Proxy setting

The Gnome desktop interface provides proxy configuration settings and apparently a lot of GUI programs will use this settings. This said, I am afraid these settings need to be changed for each user. (I can’t remember where I cam across this information and if it wrong maybe someone can let me know and I will update this.)

Gnome-Desktop proxy settings can be changed from a GUI tool or you can edit the file directly. The image below shows where to find the GUI tool under

System –> Preferences –> Network Proxy

You can edit the proxy settings here. I have a proxy configuration file available so I have set the automatic proxy config setting, however you can set the proxy manually here as well. The advanced tab allows you to specifically define addresses to ignore the proxy for (i.e. the local subnet).

When using this GUI tool Gnome stores the proxy config settings in the following folders and files. ~ indicates the users home directory and the . hides the folder or file(see notes below for further explanation)

~/.gconf/system/proxy/%gconf.xml (used for the manual and advanced settings)
~/.gconf/system/http_proxy/%gconf.xml (used for the automatic settings)

I can’t tell you why it is split into two files but it appears to be so.

Proxy Environment Variables

Like the Gnome proxy settings above, the Environment variables are apparently for Command Line programs to provide a central area that these programs can look to for proxy config.

There are a number of proxy environment variables but I will concentrate on just 3 that apply to my network setup. These are

1. http_proxy
2. https_proxy
3. ftp_proxy

I think these are pretty self explanatory.

To set these there is no GUI (that I am aware of), so we have to go to the command line. We need to fire up Terminal this is found in

Applications–> Accessories –> Terminal

The terminal should start in the users home folder ~ (see notes), you should see a prompt like this

[<username>@<machine_name> ~]#

or 

[<username>@<machine_name> ~]$

<username> should be the logged on user
<machine_name> should be the computer name you are on.
The # or the $ is dependent on whether you are logged in as a user or root. # indicates root, $ indicates normal user.

We can set the environment variables at the command prompt by typing

http_proxy=”http://<proxyserver>:<proxyport>”

Now the same applies to the other environment variables. However at the moment these environment variables are only valid within this particular Terminal session. If we were to fire up another program or terminal session theses environment variables would not exist in their scope. So to make the environment variables global we need to export them, this is done using the export command. We can export any number of variables by separating them with a space.

export http_proxy https_proxy ftp_proxy

Another issue here is that this is not a permanent change, if we reboot these variables will be lost. So to get around that we need to change a log on script called profile. The script is found here

/etc/profile

OK, so how do we edit a file? I am going to give a brief introduction to vi (mainly because I have only just got my head into it) and some basic bash commands.

So in the terminal window change directory to /etc/.

To get to this directory use the following bash commands

CD / (will take you to the root directory)

CD etc (will take you into the /etc directory)

Now we are in this folder, we can use the following command to list the contents..

ls

In the list of files and folders you should see the file profile listed.

OK now type

vi profile

This puts us into the vi editor, a command line text editor. Now I found this a bit weird a first but I am gradually getting the hang of it. The editor opens up in a mode called command mode. It will allow you to scroll up and down, but not allow you to modify text. This is where you have to change modes, in this case we want to go to insert mode. This can be achieved by hitting the escape key and then i or a

<esc> a/i

You should see at the bottom of the terminal window that – INSERT – appears, to indicate you are in INSERT mode. You can now modify the file. To quit out of this mode hit <esc> at anytime (—INSERT –) should disappear from the bottom of the terminal window.

OK so now we need to enter some the commands to set the variables. So somewhere in the profile file enter the following.

http_proxy=http://<proxyserver>:<proxyport>
https_proxy=$http_proxy
ftp_proxy=$http_proxy

export http_proxy https_proxy ftp_proxy

In my case the same proxy handles http, https and ftp. My script therefore sets the http_proxy variable and then sets the others to the http_proxy value. If you have different settings for https and ftp get rid of the $http_proxy and replace with the direct setting (as with the http_proxy above). Once these have been set I then export the variables to make them global.

OK so we need to save the file by issuing the write command. Hit escape and enter :w <enter>

<esc> :w <enter>

The bottom line should change to show something like

"profile" 60L, 1062C written

Now we have saved the file, we need to quit the editor. The quit command is

<esc> :q <enter>

While using the editor you may find you want to quit without saving, although you have made changes. Now if you just issue the command above it will complain that there are unsaved changes. so to quit without saving changes you can force it by typing

<esc> :q! <enter>

In addition you can combine commands, so to quit and save type

<esc> :wq <enter>

You should now reboot.

You can test that the changes have worked by firing up the terminal (as above) and typing the following command

echo $http_proxy

You should get the value you set in the profile file. The same applies to the other variables if you want to check them.

YUM - Software Updater and Add/remove Software - Proxy Setting

There are two locations within CentOS GUI to run software update tools (software updates and software installations). These are

• Applications –> System Tools –> Software Updater
• Applications –> Add/Remove Software

 

They both run the same underlying command line application YUM (Yellowdog Updater, Modified) but the Software updater allows for installed software (packages) to be updated, where as the Add/Remove Software option will allow you to add and remove software (packages) from defined repositories. (Repositories are locations on the web/network that software packages can be downloaded/updated from, CentOS comes with a set of predefined repositories but you can add custom repositories when needed).

Now the proxy setting for YUM cannot be configured within any of the GUIs, it has to be done within the configuration files. I will quickly go through this, but it will involve using the vi editor, I will not explain the commands here please see the previous section on environment variables for more details on the each command.

The YUM configuration is yum.conf and is found in /etc/

/etc/yum.conf

Enter the vi editor

vi /etc/yum.conf

enter insert mode

<esc> i

find the line that says proxy= and change it to your proxy server settings, if your file does not contain this setting just add it in the first clear line in the [main] section.

proxy=http://<proxyserver>:<proxyport>

Quit and save vi.

<esc> :wq

Now fire up either the Software updater or the Add/Remove Software. You should find that both tools are able to connect to the defined repositories. you can install any updates you require.

Firefox – Proxy Settings

Now I talked about GUI programs respecting the Gnome proxy settings and I believe Firefox does. I really only include this here as a FYI (I messed with the settings when I was trying to work out what was going on with all the proxies). It appears that the default for the proxy settings in Firefox is to “Use System Proxy settings” which means it looks for the Gnome settings. So if you make the changes above you should not have to worry about this.

Open up Firefox and select preferences

Edit –> Preferences

In the advanced section, under the network tab, click settings

Once in Connection settings you can change the your proxy settings.

Notes

1. The folder ~ is actually a shortcut referring to the logged on users home folder (you can see why the setting must be configured for each user). The physical user home folder can be located here /home/<username>.
2. The . on the beginning of the file or folder name is a way to hide the file or folder from normal folder browsing.

Other parts in this series

• Introduction
• Install CentOS (and initial configuration) for the Windows Sys Admin.
  1. Part 1 - Basic Install
  2. Part 2 - Initial Configuration
  3. Part 3 - Proxy configuration
  4. Part 4 - SSH (Secure shelling)
  5. Part 5 - Setting up VNC Server (inc firewall)
  6. Part 6 - Setup Windows Authentication integration.
  7. Part 7 - Tips
• Online Documentation (all the good articles I have found on the tinterweb).

Part 3 - CentOS Proxy Configuration

Part 1 – CentOS basic install.

Introduction

As i have already said I am a Windows Guy and this is my first serious foray into Linux. I make no apology for the basic nature of this walkthrough or the inaccuracies in it. I just hope it allows someone to easily get started with Linux, while explaining what is going on (to the best of my knowledge), without having to go searching the net for various information.

So after having to have setup a Linux (CentOS) machines for my employer and failing to find a decent all in one tutorial from a windows perspective, (not to say I haven’t found any good articles, I have and I list these in the last section of this series of posts). I thought I would try and provide a simple walkthrough of how to setup CentOS. This install is a completely fresh install and will wipe anything on the disk, no dual booting etc…

Linux (CentOS) – Basic Install

Setting the scene: The machines I am using for this are old Compaq DL380 G1s, with 3 x 9GB drives in a Raid 5 config. I had create one logical drive.

OK lets get started, I am assuming you have got yourself either the CentOS 6 CD installation set or the DVD.

Boot the machine from the CentOS Disc.

Press Enter to install in graphical mode.

Here you can test the CD media or skip the Test. (I had done installs already from this media so I skipped this, plus I had old hardware and this can take a while).

Click Next.

Select your language.

Select your keyboard layout.

  Ok this screen I got because the disk I had was completely blank as I had just created the raid area and logical drive. This is only a warning message that data is going to be overwritten, I had nothing on the drive so I clicked Yes.

I was performing a complete fresh install so I left everything on this screen as is. Click Next.

Another warning message about overwriting data, Click Yes.

Ok in my situation I needed to manually setup my IP addresses. Click Edit button to manually change IP configuration.

Here, after manually editing the network device eth0, I have added the gateway and DNS settings. A point to mentioned here is that I sit behind a proxy server, we will come back to this later as the gnome (desktop manager), yum (software repositiory) and web browser will all need to be configured to work with the proxy. So if you sit behind a proxy don’t expect by setting up your IP info here that the Linux install will connect to the tinterweb.

Select your location, either from the drop down or you can select it on the map.

OK, the root user in Linux is equivalent to the Administrator account in windows. Now I know the practice in Windows is to rename your Administrator account to a less obvious name. I don’t know if the same can be said for the root account in Linux? Anyway just be aware this user is GOD and can do everything, so should be treated with care, and the password complexity should be equivalent to  its status.

Ok here you can select what you want to be installed, grouped together into categories, during the initial installation, you can always install features later, after CentOS is installed. I choose to install the Desktop – Gnome, Server components and the Server – GUI (adds GUI interfaces to the server components) components (being a windows guy ;o) ).
I did not choose the Packages from CentOS, the reason being that this will not update until the proxy is configured and I could not do this during the install wizard. I did try this on the first install I did and it took ages to time out, so if you have a proxy don’t select this option. OK, we are ready to install, click Next.

This screen is a warning insuring you have all of your CDs prepared, there are actually 6 CDs in the complete set and I believe it just tells you here what exactly you need, depending on the installation selections you have made ( I only need the first 4 CDs).

The installation begins, with the setup of the hard disk and then software installation.

Go to part 2

Other parts in this series

• Introduction
• Install CentOS (and initial configuration) for the Windows Sys Admin.
  1. Part 1 - Basic Install
  2. Part 2 - Initial Configuration
  3. Part 3 - Proxy configuration
  4. Part 4 - SSH (Secure shelling)
  5. Part 5 - Setting up VNC Server (inc firewall)
  6. Part 6 - Setup Windows Authentication integration.
  7. Part 7 - Tips
• Online Documentation (all the good articles I have found on the tinterweb).

Part 1 – CentOS basic install.