subversion, saslauthd, ldap and encryption

[Dan White]

On 10/01/12 15:44 +0200, Arnau Bria wrote:
>This is my first e-mail in this list. My name is Arnau Bria and I live
>in Barcelona (SPAIN). Let me say hi to everybody.
>I have a problem with svn+saslauth+ldap. I think this is the correct
>place for asking it cause the error is SASL related.
>
> I had a svn server using sasldb file for
>authentication and sasl for data encryption.
>[general]
>authz-db = authzfile
>anon-access = none
>realm = puppet
>
>[sasl]
>use-sasl = true
>min-encryption = 128
>max-encryption = 256
>
># cat /etc/sasl2/svn.conf
>pwcheck_method: auxprop
>auxprop_plugin: sasldb
>sasldb_path: /etc/my_sasldb
>mech_list: DIGEST-MD5
>
>It worked really fine.


>SOCKETDIR=/var/run/saslauthd
>MECH="ldap"
>FLAGS=
>START="yes"
>
>#/usr/lib64/sasl2/svn.conf
>pwcheck_method: saslauthd
>auxprop_plugin: ldap
>mech_list: PLAIN LOGIN
>ldapdb_mech: PLAIN LOGIN
>
>
>Works fine. this is a ldaps server, so data is encyrpted.
>
># testsaslauthd -u arnaubria  -p XXXXXXXX
>0: OK "Success."
>
>SVN works great too.
>
>But, when I try to add sasl encryption to SVN:
>
>[sasl]
>use-sasl = true
>min-encryption = 128
>max-encryption = 256
>
>svn give me the error :
>
>svn: Could not obtain the list of SASL mechanisms

This result is not due to the fact that you are using the ldap saslauthd
backend, but because you are using PLAIN and LOGIN, which do not provide
network protection. See:

http://www.cyrussasl.org/docs/cyrus-sasl/2.1.25/mechanisms.php

And the 'Max SSF' column.

saslauthd requires the receipt of a plain text password for verification.
DISGEST-MD5 is not possible in this kind of set up.

If you can protect your subversion session with TLS, then that may suffice.

You could use the ldapdb auxprop plugin, instead of the saslauthd ldap
backend, to support DIGEST-MD5 and network protection.

>From Subversion guide:
>
>http://svnbook.red-bean.com/en/1.5/svn.serverconfig.svnserve.html#svn.serverconfig.svnserve.sasl
>
>that min/max-encyrption value encrypts data over the network, but then
>ldap auth does not work.
>What is happening when I add data encryption? why auth fails? (I have
>a guess: when adding in-encryption auth is also encrypted and ldap does
>not know how to reply... am I right?)
>
>May I use SALA for network encrytption when doing auth thorugh ldap?
>
>
>TIA,
>Arnau
>

-- 
Dan White