建站
咨詢
售后
建站咨詢
新聞中心
這里有您想知道的互聯(lián)網(wǎng)營銷解決方案
Linux下下配置svn的https訪問
Apache Subversion 通常被縮寫成 SVN，是一個開放源代碼的版本控制系統(tǒng)，Subversion 在 2000 年由 CollabNet Inc 開發(fā)，現(xiàn)在發(fā)展成為 Apache 軟件基金會的一個項目，同樣是一個豐富的開發(fā)者和用戶社區(qū)的一部分。 SVN相對于的RCS、CVS，采用了分支管理系統(tǒng)，它的設(shè)計目標(biāo)就是取代CVS?；ヂ?lián)網(wǎng)上免費的版本控制服務(wù)多基于Subversion。
成都創(chuàng)新互聯(lián)主打移動網(wǎng)站、網(wǎng)站制作、成都網(wǎng)站設(shè)計、網(wǎng)站改版、網(wǎng)絡(luò)推廣、網(wǎng)站維護(hù)、域名注冊、等互聯(lián)網(wǎng)信息服務(wù)，為各行業(yè)提供服務(wù)。在技術(shù)實力的保障下，我們?yōu)榭蛻舫兄Z穩(wěn)定，放心的服務(wù)，根據(jù)網(wǎng)站的內(nèi)容與功能再決定采用什么樣的設(shè)計。最后，要實現(xiàn)符合網(wǎng)站需求的內(nèi)容、功能與設(shè)計，我們還會規(guī)劃穩(wěn)定安全的技術(shù)方案做保障。
搭建SVN服務(wù)器
1.使用yum命令安裝svn服務(wù)器
[root@localhost ~]# yum install -y subversion
2.可以使用命令查看svn是否安裝成功
[root@localhost ~]# svn
使用“svn help”得到用法。
[root@localhost ~]# svn help
[root@localhost ~]# svn --version
[root@localhost ~]# svnadmin help
...
3.創(chuàng)建svn服務(wù)器的倉庫
先創(chuàng)建目錄(這里目錄可以隨意，我為了方便自己管理就起了 /wfq)
[root@localhost /]# mkdir /wfq/svn/project
然后創(chuàng)建倉庫，倉庫目錄指定為剛才創(chuàng)建的目錄
[root@localhost /]# svnadmin create /wfq/svn/project
因為我們創(chuàng)建文件夾時使用root權(quán)限創(chuàng)建的所以我們需要修改組權(quán)限，防止因為權(quán)限不夠而svn操作失敗
[root@localhost /]# chown -R apache:apache /wfq/svn/project
進(jìn)入到該目錄中就會發(fā)現(xiàn)生成了很多文件，文件中svn中最主要的配置就在conf目錄中
[root@localhost /]# cd /wfq/svn/project/
[root@localhost project]# ll
總用量 8
drwxr-xr-x. 2 root root 54 1月 19 02:12 conf
drwxr-sr-x. 6 root root 233 1月 19 02:12 db
-r--r--r--. 1 root root 2 1月 19 02:12 format
drwxr-xr-x. 2 root root 231 1月 19 02:12 hooks
drwxr-xr-x. 2 root root 41 1月 19 02:12 locks
-rw-r--r--. 1 root root 229 1月 19 02:12 README.txt
[root@localhost project]# cd conf/
[root@localhost conf]# ll
總用量 12
-rw-r--r--. 1 root root 1080 1月 19 02:12 authz
-rw-r--r--. 1 root root 309 1月 19 02:12 passwd
-rw-r--r--. 1 root root 3090 1月 19 02:12 svnserve.conf
conf–|
–| authz —svn的權(quán)限配置
–| passwd —svn的密碼配置(注意：因為我們要使用httpd 所以這里的密碼驗證文件不是密碼文件所以不可以用)
–| svnserve.conf —svn的基本配置文件
4.SVN指定庫啟動與關(guān)閉
? 1.命令方式啟動（有缺陷）
關(guān)閉svn
[root@localhost ssl]# ps -ef|grep svnserve
root 1438 1 0 19:06 ? 00:00:00 /usr/bin/svnserve --daemon --pid-file=/run/svnserve/svnserve.pid -r /wfq/svn
root 1493 1137 0 19:23 pts/0 00:00:00 grep --color=auto svnserve
[root@localhost ssl]#kill -9 1438
啟動指定目錄
[root@localhost ssl]# svnserve -d -r /wfq/svn/
[root@localhost ssl]# ps -ef|grep svnserve
root 1509 1 0 19:24 ? 00:00:00 svnserve -d -r /wfq/svn/
root 1511 1137 0 19:24 pts/0 00:00:00 grep --color=auto svnserve
[root@localhost ssl]# systemctl restart httpd
這種方式有點缺點就是不能 使用下面這幾個命令來控制svn服務(wù)
[root@localhost ssl]# systemctl start svnserve
[root@localhost ssl]# systemctl restart svnserve
[root@localhost ssl]# systemctl stop svnserve
[root@localhost ssl]# systemctl status svnserve
2.修改默認(rèn)的啟動目錄
? 將OPTIONS=”-r /wfq/svn”變量修改未上面創(chuàng)建的根目錄
[root@localhost ssl]# vi /etc/sysconfig/svnserve
# OPTIONS is used to pass command-line arguments to svnserve.
#
# Specify the repository location in -r parameter:
OPTIONS="-r /wfq/svn"
重啟
[root@localhost ssl]# systemctl restart svnserve
[root@localhost ssl]# systemctl restart httpd
創(chuàng)建 apache環(huán)境支持http svn連接
1.使用yum源下載httpd和mod_dav_svn兩個模塊
? httpd模塊 是Apache超文本傳輸協(xié)議(HTTP)服務(wù)器的主程序。被設(shè)計為一個獨立運行的后臺進(jìn)程，它會建立一個處理請求的子進(jìn)程或線程的池。
? mod_dav_svn 配置指令 模塊 是通過 Apache HTTP 服務(wù)器提供 Subversion 版本庫服務(wù)的配置說明。
[root@localhost project]# yum install -y httpd mod_dav_svn
2.創(chuàng)建用戶和密碼文件，并且配置svn權(quán)限
? 創(chuàng)建密碼文件 htpasswd 命令中 最后面的是用戶名，然后輸入密碼回車，再次確認(rèn)密碼回車就會創(chuàng)建好文件
? 如果要追加用戶的話就使用 -m 命令 去掉c命令否則會覆蓋了
? 使用命令查看后則會發(fā)現(xiàn)已創(chuàng)建該用戶
[root@localhost /]# htpasswd -cm /wfq/svn/project/conf/http-auth bugwfq
New password:
Re-type new password:
Adding password for user bugwfq
[root@localhost /]# vi /wfq/svn/project/conf/http-auth
bugwfq:$apr1$0FjoVFII$Zb4G0C8/r3ooQKPmcJHCi/
~
~
~
進(jìn)入到 conf/authz 文件中配置權(quán)限詳細(xì)配置方式請參考 配置詳解
[root@localhost /]# vi /wfq/svn/project/conf/authz
### This file is an example authorization file for svnserve.
### Its format is identical to that of mod_authz_svn authorization
### files.
### As shown below each section defines authorizations for the path and
### (optional) repository specified by the section name.
### The authorizations follow. An authorization line can refer to:
### - a single user,
### - a group of users defined in a special [groups] section,
### - an alias defined in a special [aliases] section,
### - all authenticated users, using the '$authenticated' token,
### - only anonymous users, using the '$anonymous' token,
### - anyone, using the '*' wildcard.
###
### A match can be inverted by prefixing the rule with '~'. Rules can
### grant read ('r') access, read-write ('rw') access, or no access
### ('').
[aliases]
# joe = /C=XZ/ST=Dessert/L=Snake City/O=Snake Oil, Ltd./OU=Research Institute/CN=Joe Average
[groups]
# harry_and_sally = harry,sally
# harry_sally_and_joe = harry,sally,&joe
admin = bugwfq #配置用戶組 admin 組內(nèi)成員 admin= zs，ls，ww
# [/foo/bar]
# harry = rw
# &joe = r
# * =
[/]
@admin = rw #所屬組權(quán)限配置 r讀w寫
# [repository:/baz/fuz]
"/wfq/svn/project/conf/authz" 37L, 1113C written
3.配置svnserve.conf 文件
去掉 下面幾個配置前面的#號
-
? anon-access = read
-
? auth-access = write
-
? password-db = http-auth (指定剛才生成的密碼文件)
-
? authz-db = authz
[root@localhost /]# vi /wfq/svn/project/conf/svnserve.conf
### This file controls the configuration of the svnserve daemon, if you
### use it to allow access to this repository. (If you only allow
### access through http: and/or file: URLs, then this file is
### irrelevant.)
### Visit http://subversion.apache.org/ for more information.
[general]
### The anon-access and auth-access options control access to the
### repository for unauthenticated (a.k.a. anonymous) users and
### authenticated users, respectively.
### Valid values are "write", "read", and "none".
### Setting the value to "none" prohibits both reading and writing;
### "read" allows read-only access, and "write" allows complete
### read/write access to the repository.
### The sample settings below are the defaults and specify that anonymous
### users have read-only access to the repository, while authenticated
### users have read and write access to the repository.
anon-access = read
auth-access = write
### The password-db option controls the location of the password
### database file. Unless you specify a path starting with a /,
### the file's location is relative to the directory containing
### this configuration file.
### If SASL is enabled (see below), this file will NOT be used.
### Uncomment the line below to use the default password file.
password-db = http-auth
### The authz-db option controls the location of the authorization
### rules for path-based access control. Unless you specify a path
### starting with a /, the file's location is relative to the the
### directory containing this file. If you don't specify an
### authz-db, no path-based access control is done.
### Uncomment the line below to use the default authorization file.
authz-db = authz
### This option specifies the authentication realm of the repository.
### If two repositories have the same authentication realm, they should
### have the same password database, and vice versa. The default realm
"/wfq/svn/project/conf/svnserve.conf" 61L, 3085C written
4.配置httpd.conf配置文件
? 服務(wù)目錄：/etc/httpd/ 主配置文件：/etc/httpd/conf/httpd.conf
? SVNParentPath /wfq/svn ##為根project 的上級目錄 AuthUserFile /wfq/svn/project/conf/httppasswd ##密碼文件位置 AuthzSVNAccessFile /wfq/svn/project/conf/authz ##權(quán)限配置
[root@localhost /]# vi /etc/httpd/conf/httpd.conf
...
ServerName locahost:80
DAV svn SVNListParentPath on SVNParentPath /wfq/svn AuthType Basic AuthName
"Subversion repositories" AuthUserFile /wfq/svn/project/conf/httppasswd AuthzSVNAccessFile /wfq/svn/project/conf/authz Require valid-user SVNAutoversioning on ModMimeUsePathInfo on
...
[root@localhost /]#
5.修改svn目錄下文件的屬主和屬組
[root@localhost /]# cd /wfq/svn/
[root@localhost svn]# chown -R apache. project/
[root@localhost svn]# ll
總用量 0
drwxr-xr-x. 6 apache apache 86 1月 19 02:12 project
[root@localhost svn]# ll project/
總用量 8
drwxr-xr-x. 2 apache apache 71 1月 19 03:21 conf
drwxr-sr-x. 6 apache apache 233 1月 19 02:12 db
-r--r--r--. 1 apache apache 2 1月 19 02:12 format
drwxr-xr-x. 2 apache apache 231 1月 19 02:12 hooks
drwxr-xr-x. 2 apache apache 41 1月 19 02:12 locks
-rw-r--r--. 1 apache apache 229 1月 19 02:12 README.txt
[root@localhost svn]#
? 重啟httpd
[root@localhost svn]# systemctl restart httpd
Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.
? 查看啟動失敗原因
[root@localhost svn]# systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)
Active: failed (Result: exit-code) since 六 2019-01-19 03:57:46 CST; 1min 30s ago
Docs: man:httpd(8)
man:apachectl(8)
Process: 1952 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=1/FAILURE)
Process: 1951 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=0/SUCCESS)
Main PID: 1951 (code=exited, status=0/SUCCESS)
1月 19 03:57:46 localhost.localdomain systemd[1]: Starting The Apache HTTP Server...
1月 19 03:57:46 localhost.localdomain httpd[1951]: httpd (pid 1600) already running
1月 19 03:57:46 localhost.localdomain kill[1952]: kill: cannot find process ""
1月 19 03:57:46 localhost.localdomain systemd[1]: httpd.service: control process exited, code=exited status=1
1月 19 03:57:46 localhost.localdomain systemd[1]: Failed to start The Apache HTTP Server.
1月 19 03:57:46 localhost.localdomain systemd[1]: Unit httpd.service entered failed state.
1月 19 03:57:46 localhost.localdomain systemd[1]: httpd.service failed.
查看日志
[root@localhost svn]# vi /var/log/httpd/error_log
[Sat Jan 19 02:40:38.937489 2019] [core:notice] [pid 1599] SELinux policy enabled; httpd running as context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[Sat Jan 19 02:40:38.938439 2019] [suexec:notice] [pid 1599] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Sat Jan 19 02:40:38.954448 2019] [auth_digest:notice] [pid 1600] AH01757: generating secret for digest authentication ...
[Sat Jan 19 02:40:38.965269 2019] [lbmethod_heartbeat:notice] [pid 1600] AH02282: No slotmem from mod_heartmonitor
[Sat Jan 19 02:40:38.992931 2019] [mpm_prefork:notice] [pid 1600] AH00163: Apache/2.4.6 (CentOS) SVN/1.7.14 configured -- resuming normal operations
[Sat Jan 19 02:40:38.992970 2019] [core:notice] [pid 1600] AH00094: Command line: 'httpd'
原來是本地80端口忘開了，這里為了方便直接關(guān)閉防火墻
[root@localhost /]# systemctl stop firewalld.service
[root@localhost /]# systemctl disable firewalld.service
然后接著重啟發(fā)現(xiàn)雖然成功了，但是訪問的時候報了500
The server encountered an internal error or misconfiguration and was unable to complete your request.
Please contact the server administrator at root@localhost to inform them of the time this error occurred, and the actions you performed just before this error.
然后我查看了下錯誤日志
[Sat Jan 19 04:42:55.749505 2019] [authn_file:error] [pid 2207] (13)Permission denied: [client 192.168.4.208:10890] AH01620: Could not open password file: /wfq/svn/project/conf/httppasswd
[Sun Jan 20 03:43:02.936928 2019] [mpm_prefork:notice] [pid 2202] AH00171: Graceful restart requested, doing restart
發(fā)現(xiàn)是新裝的系統(tǒng)SELinux未關(guān)閉，授權(quán)沒有生效。
有兩種處理方案：
1.永久關(guān)閉selinux并重啟系統(tǒng)
[root@localhost ~]# vi /etc/selinux/config
將SELINUX=enforcing修改為SELINUX=disabled
重啟系統(tǒng)reboot命令 應(yīng)用相關(guān)設(shè)置
參考文章：linux 關(guān)閉selinux
2.命令方式直接修改SVN目錄的權(quán)限配置
chcon -R -h -t httpd_sys_content_t /wfq/svn/project
然后訪問地址http://ip/svn/project 輸入設(shè)置的賬號和密碼 看到該界面就說明訪問成功了
升級為https訪問
1.SSL環(huán)境搭建
SSL數(shù)字證書
? 1.下載openssl與mod_ssl模塊
[root@localhost ~]# yum install -y openssl mod_ssl
? 2.生成key和證書
[root@localhost ~]# mkdir /etc/httpd/conf/ssl/
[root@localhost ~]# cd /etc/httpd/conf/ssl/
[root@localhost ssl]# ll
總用量 0
[root@localhost ssl]# openssl genrsa -des3 -out server.key 1024
Generating RSA private key, 1024 bit long modulus
............++++++
...............++++++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
生成csr
[root@localhost ssl]# openssl req -new -key server.key > server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN #國家名稱（2個字母代碼）
State or Province Name (full name) []:gd #省份
Locality Name (eg, city) [Default City]:sz #城市
Organization Name (eg, company) [Default Company Ltd]:xx #公司名稱
Organizational Unit Name (eg, section) []:xx #公司部門
Common Name (eg, your name or your server's hostname) []:bugwfq #主機(jī)名 Email Address []:bugwfq@163.com #郵件地址 Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:123456 #密碼 An optional company name []:bugwfq #可選的公司名稱 ... #生成證書 [root@localhost ssl]# openssl req -x509 -days 2048 -key server.key -in server.csr > server.crt Enter pass phrase for server.key: [root@localhost ssl]# ll 總用量 12 -rw-r--r-- 1 root root 997 1月 21 23:27 server.crt -rw-r--r-- 1 root root 729 1月 21 23:26 server.csr -rw-r--r-- 1 root root 963 1月 21 23:22 server.key 如果使用的阿里云服務(wù)器，并且有域名則找到對應(yīng)的域名管理，開啟ssl證書然后下載apache 對應(yīng)的證書
會生成以下幾個文件
將這些文件放到 /etc/httpd/conf/ssl 目錄下
2.配置SSL環(huán)境
\1. 打開/etc/httpd/conf/httpd.conf 配置文件配置以下信息
[root@localhost /]# vi /etc//httpd/conf/httpd.conf
...
# Load config files in the "/etc/httpd/conf.d" directory, if any.
...
LoadModule ssl_module modules/mod_ssl.so
Mutex default ssl-cache
SSLRandomSeed startup builtin
SSLSessionCache none
SSLCertificateFile conf/ssl/server.crt
SSLCertificateKeyFile conf/ssl/server.key
#SSLCertificateChainFile conf/ssl/X_X_X_chain.crt #如果是openssl 生產(chǎn)的可以不配，如果是正規(guī)機(jī)構(gòu)配置的可以放上去
...
DAV svn ... ModMimeUsePathInfo on SSLRequireSSL
#配置該行，
2.重啟httpd
[root@localhost /]# systemctl restart httpd
然后訪問對應(yīng)的地址 https://xxx.xxx.xxx.xxx/svn/project
因為我使用openssl 生成得，所以雖然證書可以了，但是只適用于開發(fā)環(huán)境，上面還會出現(xiàn)證書不安全的提示
(需要在電腦上手動安裝證書 在這里就不提了)
如果我們從專門得證書機(jī)構(gòu)申請證書就不會出現(xiàn)提示（下面這個是我自己阿里云申請配置的）
3.設(shè)置http重定向到https
? 因為默認(rèn)是http請求
所以我們要把http請求重定向到https的請求方式
1.修改配置文件
打開/etc/httpd/conf/httpd.conf 配置文件配置以下信息
1).添加mod_rewrite.so模塊
...
LoadModule ssl_module modules/mod_ssl.s 我添加在了這一行下面
LoadModule rewrite_module modules/mod_rewrite.so
...
2.配置重定向規(guī)則
...
我配置在了
標(biāo)簽上方 RewriteEngine on RewriteCond %{SERVER_PORT} !^443$ RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
...
3.重啟httpd
[root@localhost ssl]# systemctl restart httpd
搞定
注意：
有時候可能回遇到不同情況要多看日志或啟動信息去解決，配置文件的配置可能每個電腦上配置的方式會有所差異
在配置的時候盡量多摸索，多查詢網(wǎng)上其他資料。
在這里附上我用到的一些命令
svnserve -d -r /路徑 #指定目錄啟動其中 -d 表示守護(hù)進(jìn)程-r 表示在后臺執(zhí)行 /路徑 為svn的安裝目錄
ps -ef|grep svnserve #這里是采取linux殺死進(jìn)程的方式關(guān)閉SVN
kill -9 pid #殺死進(jìn)程， 此4967為進(jìn)程號
systemctl start 服務(wù)名 #啟動服務(wù) httpd/svnserve/........
systemctl stop 服務(wù)名 #關(guān)閉服務(wù) httpd/svnserve/........
systemctl restart 服務(wù)名 #重啟服務(wù) httpd/svnserve/........
systemctl status 服務(wù)名 #服務(wù)的狀態(tài)查看 可以查詢錯誤
此外，用戶的存儲也可以使用mysql http://www.cnblogs.com/lxmhhy/p/6044054.html
新聞標(biāo)題：Linux下下配置svn的https訪問
當(dāng)前網(wǎng)址：http://www.5511xx.com/article/dpgocgi.html
