What should I consider to secure SVN on Windows? [closed]
Currently I am using VisualSVN Server and it's only accessible on my home network. Eventually there will be others accessing it, but for now it's just me and I would like to be able to go down to the coffee shop (or wherever) and be able to work away from the house.
Currently I'm accessing the server at http://user-pc:xx/svn/Projects/. When I setup my router to forward port XX to my server, what steps should I take to secure the server?
Keep in mind that I am doing this on Windows and while I use the regular command prompt extensively, I haven't been on SVN very long and haven't used anything other than TortoiseSVN to work with it up to this point.
Edit: The only harmful thing an attacker could do, that I'm aware of, is to: guess my port number, username, and password to get into the repository. However as the saying goes, I don't know what I don't know.
So I'm not necessarily asking for step by step instructions (although I would certainly like to have that too) as much as what things I need to keep in consideration for any kind of attack that could be made once the port is open.
- Use good password strength to secure the VisualSVN server
- Use a higher port for the server e.g. 39517 instead of the default port 80 or 443. Makes it harder for an attacker to guess. The attacker would have to rely on a port scan.
- VisualSVN server will not allow anonymous access. You need to explicitly define users.
- Give user access only to people you know/trust.
- Use https on server side, not plain http (AuthType Basic is interceptable) of use Digest auth (have to configure Apache by hand)
- Use (free) CA-issued cert on server, not self-signed (you can use self-signed cert, but will have (?) to verify it by eye every time)
- Maintain up-to-date VisualSVN Server version (with fixes for possible problems in Apache and|or SVN itself)
- Enable logging in httpd.conf for security-audit (no logging by default in VisualSVN Server)