TortoiseSVN
A Subversion client for Windows
Version 1.4.1
Stefan Küng
Lübbe Onken
Simon Large
2006/10/13 22:32:24 (r7765)
3.2. Svnserve Based Server
3.2.1. Introduction
There may be situations where it's not possible to use Apache as your server. Fortunately, Subversion includes Svnserve - a lightweight stand-alone server which uses a custom protocol over an ordinary TCP/IP connection.
In most cases svnserve is easier to setup and runs faster than the Apache based server.
3.2.2. Installing svnserve
Get the latest version of Subversion from http://subversion.tigris.org/servlets/ProjectDocumentList?folderID=91 .
If you already have a version of Subversion installed, and svnserve is running, you will need to stop it before continuing.
Run the Subversion installer. If you run the installer on your server you can skip step 4.
Open the windows-explorer, go to the installation directory of Subversion (usually C:\Program Files\Subversion) and in the bin directory, find the files svnserve.exe, libdb44.dll, libeay32.dll and ssleay32.dll - copy these files into a directory on your server e.g. c:\svnserve
3.2.3. Running svnserve
Now that svnserve is installed, you need it running on your server. The simplest approach is to run the following from a DOS shell or create a windows shortcut:
svnserve.exe --daemon
svnserve will now start waiting for incoming requests on port 3690. The --daemon switch tells svnserve to run as a daemon process, so it will always exist until it is manually terminated.
If you have not yet created a repository, follow the instructions given with the Apache server setup Section 3.1.4, “Configuration”.
To test that svnserve is working, use TortoiseSVN → Repo-Browser to view a repository.
Assuming your repository is located in c:\repos\TestRepo, and your server is called localhost, enter:
svn://localhost/repos/TestRepo
when prompted by the repo browser.
You can also increase security and save time entering Url's with svnserve by using the --root switch to set the root location and restrict access to a specified directory on the server:
svnserve.exe --daemon --root drive:\path\to\repository
Using the previous test as a guide, svnserve would now run as:
svnserve.exe --daemon --root c:\repos
And in TortoiseSVN our repo-browser Url is now shortened to:
svn://localhost/TestRepo
Note that the --root switch is also needed if your repository is located on a different partition or drive than the location of svnserve on your server.
Warning
Do not create or access a Berkeley DB repository on a network share. It cannot exist on a remote filesystem. Not even if you have the network drive mapped to a drive letter. If you attempt to use Berkeley DB on a network share, the results are unpredictable - you may see mysterious errors right away, or it may be months before you discover that your repository database is subtly corrupted.
3.2.3.1. Run svnserve as a Service
If you are concerned about always having a user logged in on your server, or worried about someone shutting down svnserve or forgetting to restart it after a reboot, it is possible to run svnserve as a windows service. Starting with Subversion 1.4, svnserve can be installed as a native windows service, in previous versions it can be installed using a wrapper.
To install svnserve as a native windows service, execute the following command all on one line to create a service which is automatically started when windows starts.
sc create svnserve binpath= "c:\svnserve\svnserve.exe --service
--root c:\repos" displayname= "Subversion" depend= tcpip start= auto
Tip
Microsoft now recommend services to be run as under either the Local Service or Network Service account. Refer to The Services and Service Accounts Security Planning Guide . To create the service under the Local Service account, append the following to the example above.
obj= "NT AUTHORITY\LocalService"
Note that you would have to give the Local Service account appropriate rights to both Subversion and your repositories, as well as any applications which are used by hook scripts.
To install svnserve using a wrapper, one written specifically for svnserve is SvnService. Magnus Norddahl adapted some skeleton code from Microsoft, and further improvements have been made by Daniel Thompson. Daniel's version is available for download from tigris.org .
More generic tools like firedaemon will also work. Note that you will still need to run svnserve with the --daemon switch.
Finally, if you have access to the Windows 2000/XP/2003 resource kit you can use SrvAny from Microsoft. This is the official Microsoft way of running programs as services, but it is a bit messy (requires registry editing) and if you stop the service it will kill svnserve immediately without letting it clean up. If you don't want to install the entire reskit, you can download just the SrvAny components from Daniel Petri .
3.2.4. Authentication with svnserve
The default svnserve setup provides anonymous read-only access. This means that you can use an svn:// Url to checkout and update, or use the repo-browser in TortoiseSVN to view the repository, but you won't be able to commit any changes.
To enable write access to a repository, you need to edit the conf/svnserve.conf file in your repository directory. This file controls the configuration of the svnserve daemon, and also contains useful documentation.
You can enable anonymous write access by simply setting:
[general]
anon-access = write
However, you will not know who has made changes to a repository, as the svn:author property will be empty. You will also be unable to control who makes changes to a repository. This is a somewhat risky setup!
One way to overcome this is to create a password database:
[general]
anon-access = none
auth-access = write
password-db = userfile
Where userfile is a file which exists in the same directory as svnserve.conf. This file can live elsewhere in your filesytem (useful for when you have multiple repositories which require the same access rights) and may be referenced using an absolute path, or a path relative to the conf directory. If you include a path, it must be written /the/unix/way. Using \ or drive letters will not work. The userfile should have a structure of:
[users]
username = password
...
This example would deny all access for unauthenticated (anonymous) users, and give read-write access to users listed in userfile.
Tip
If you maintain multiple repositories using the same password database, the use of an authentication realm will make life easier for users, as TortoiseSVN can cache your credentials so that you only have to enter them once. More information can be found in the Subversion book, specifically in the sections Create a 'users' file and realm and Client Credentials Caching
3.2.5. Authentication with svn+ssh
Another way to authenticate users with a svnserve based server is to use a secure shell (SSH) to tunnel requests through.
With this approach, svnserve is not run as a daemon process, rather, the secure shell starts svnserve for you, running it as the SSH authenticated user. To enable this, you need a secure shell daemon on your server.
It is beyond the scope of this documentation to detail the installation and setup of a secure shell, however you can find further information in the TortoiseSVN FAQ . Search for “SSH”.
Further information about svnserve can be found in the SVN book .
3.2.6. Path-based Authorization with svnserve
Starting with Subversion 1.3, svnserve supports the same mod_authz_svn path-based authorization scheme that is available with the Apache server. You need to edit the conf/svnserve.conf file in your repository directory and add a line referring to your authorization file.
[general]
authz-db = authz
Here, authz is a file you create to define the access permissions. You can use a separate file for each repository, or you can use the same file for several repositories. Read Section 3.1.6, “Path-Based Authorization” for a description of the file format.