Folosesc CentOS 8 Stream + Apache 2.4 + Subversion.
Doresc să permit accesul la SVN numai utilizatorilor care aparțin unui anumit grup LDAP (svn-users).
Am urmatoarele probleme.
cazul 1. Introduceți ID-ul/PW corect ca utilizator LDAP aparținând utilizatorilor svn
Acest lucru funcționează conform așteptărilor.
Acest utilizator poate accesa SVN.
cazul 2. Introduceți ID-ul/PW corect ca utilizator LDAP care nu aparține utilizatorilor svn
Acest lucru nu funcționează așa cum era de așteptat.
Mă așteptam ca acest utilizator să nu poată accesa SVN, dar în realitate poate.
cazul 3. Introduceți ID-ul LDAP/PW greșit
Apare 500 Internal Server Error.
Pentru browsere, dialogul de autentificare de bază nu reapare și utilizatorul trebuie să repornească browserul.
Vreau să rezolv cazurile 2 și 3.
Ma poate ajuta cineva?
Configurația și jurnalul meu sunt mai jos.
/etc/httpd/conf/httpd.conf
[root@my-redmine conf]# cat httpd.conf | egrep -v „^\s*#|^$”
ServerRoot „/etc/httpd”
Ascultă 80
Includeți conf.modules.d/*.conf
Utilizator apache
Grup apache
ServerAdmin root@localhost
<Director />
AllowOverride nici unul
Solicitați refuzul tuturor
</Director>
DocumentRoot „/var/www/html”
<Directorul „/var/www”>
AllowOverride Nici unul
Solicitați toate acordate
</Director>
<Directorul „/var/www/html”>
Opțiuni Indexuri FollowSymLinks
AllowOverride Nici unul
Solicitați toate acordate
</Director>
<IfModule dir_module>
DirectoryIndex index.html
</IfModule>
<Fișiere „.ht*”>
Solicitați refuzul tuturor
</Fișiere>
ErrorLog „logs/error_log”
Avertizare LogLevel
<IfModule log_config_module>
LogFormat „%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinat
LogFormat „%h %l %u %t \”%r\” %>s %b” comun
<IfModule logio_module>
LogFormat „%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinat
</IfModule>
CustomLog „logs/access_log” combinat
</IfModule>
<IfModule alias_module>
ScriptAlias /cgi-bin/ „/var/www/cgi-bin/”
</IfModule>
<Directorul „/var/www/cgi-bin”>
AllowOverride Nici unul
Opțiuni Niciuna
Solicitați toate acordate
</Director>
<IfModule mime_module>
TypesConfig /etc/mime.types
Aplicație AddType/x-compress .Z
Aplicație AddType/x-gzip .gz .tgz
AddType text/html .shtml
AddOutputFilter INCLUDE .shtml
</IfModule>
AddDefaultCharset UTF-8
<IfModule mime_magic_module>
MIMEMagicFile conf/magic
</IfModule>
Activare EnableSendfile activată
IncludeOpțional conf.d/subversion.conf
[root@my-redmine conf]#
/etc/httpd/conf,d/subversion.conf
[root@my-redmine conf.d]# cat subversion.conf | egrep -v „^\s*#|^$”
<Locație /svn/svn-test>
DAV svn
SVNPath /usr/local/svn/svn-test
Depanare LogLevel
AuthLDAPBindDN <MyAdmin>
AuthLDAPBindPassword <MyAdminPassword>
LDAPRecomandări dezactivate
AuthLDAPBindAuthoritative dezactivat
AuthType Basic
AuthName „Depozitul subversiune (LDAP)”
AuthBasicAuthoritative dezactivat
AuthUserFile /dev/null
AuthBasicProvider ldap
AuthzSVNAccessFile /usr/local/svn/svn-test/authzsvn.conf
AuthLDAPGroupAttributeIsDN dezactivat
AuthLDAPGroupAttribute memberUid
AuthLDAPURl ldap://192.168.100.110/ou=People,dc=my,dc=svn,dc=local?uid
Necesită ldap-group cn=svn-users,ou=Groups,dc=my,dc=svn,dc=local
</Locație>
[root@my-redmine conf.d]#
modul include
[root@my-redmine conf.d]]# httpd -t -M | grep auth
auth_basic_module (partajat)
auth_digest_module (partajat)
authn_anon_module (partajat)
authn_core_module (partajat)
authn_dbd_module (partajat)
authn_dbm_module (partajat)
authn_file_module (partajat)
authn_socache_module (partajat)
authz_core_module (partajat)
authz_dbd_module (partajat)
authz_dbm_module (partajat)
authz_groupfile_module (partajat)
authz_host_module (partajat)
authz_owner_module (partajat)
authz_user_module (partajat)
authnz_ldap_module (partajat)
authz_svn_module (partajat)
[root@my-redmine conf.d]]#
caz 1 error_log
[Marți, 20 iulie 21:56:43.046463 2021] [authz_svn:info] [pid 195900:tid 140586535274240] [client 192.168.100.120:61050] (Acces acordat)
[Tue Jul 20 21:56:43.046514 2021] [authz_core:debug] [pid 195900:tid 140586535274240] mod_authz_core.c(820): [client 192.160.168.160.168.20:6010.168.20:60.168.20. -users,ou=Groups,dc=my,dc=svn,dc=local: refuzat (niciun utilizator autentificat încă)
[Tue Jul 20 21:56:43.046519 2021] [authz_core:debug] [pid 195900:tid 140586535274240] mod_authz_core.c(820): [client 192.160.168:192.160.168:192.160.120:160.018:160.018.20:160.010.120:160.010.10. utilizator autentificat încă)
[Tue Jul 20 21:56:45.339879 2021] [authz_core:debug] [pid 195900:tid 140586518488832] mod_authz_core.c(820): [client 192.160.168.160.168.120:60.168.120.160.168.20:60.168.20. -users,ou=Groups,dc=my,dc=svn,dc=local: refuzat (niciun utilizator autentificat încă)
[Tue Jul 20 21:56:45.339918 2021] [authz_core:debug] [pid 195900:tid 140586518488832] mod_authz_core.c(820): [client 192.160.168:192.160.168:192.160.120:160.018:160.018.20:160.018:160.018.20:160.010.120. utilizator autentificat încă)
[Tue Jul 20 21:56:45.339927 2021] [authnz_ldap:debug] [pid 195900:tid 140586518488832] mod_authnz_ldap.c(523): [client 192.1 authnz_ldap.c(523): [client 192.1 authnz_ldap680.] .100.110/ou=People,dc=my,dc=svn,dc=local?uid
[Tue Jul 20 21:56:45.343581 2021] [authnz_ldap:debug] [pid 195900:tid 140586518488832] mod_authnz_ldap.c(620): [client 195900:60v060201:062:0620:06201901:01:03:00:00
[Tue Jul 20 21:56:45.343608 2021] [authz_svn:info] [pid 195900:tid 140586518488832] [client 192.168.100.120:61050] (null access): GETs
[Tue Jul 20 21:56:45.343845 2021] [authz_core:debug] [pid 195900:tid 140586518488832] mod_authz_core.c(820): [client 192.160.168.160.168.20:60.168.120:60.168.20.160.168.20. -users,ou=Groups,dc=my,dc=svn,dc=local: refuzat (niciun utilizator autentificat încă)
[Tue Jul 20 21:56:45.343852 2021] [authz_core:debug] [pid 195900:tid 140586518488832] mod_authz_core.c(820): [client 192.160.168:192.160.168:192.160.120:160.018:160.1018:1601018:1601010:1601018:160. utilizator autentificat încă)
[Tue Jul 20 21:56:45.343858 2021] [authnz_ldap:debug] [pid 195900:tid 140586518488832] mod_authnz_ldap.c(523): [client 192.1 authnz_ldap.c(523): [client 192.1 authnz_ldap:192.1 authn. .100.110/ou=People,dc=my,dc=svn,dc=local?uid
[Tue Jul 20 21:56:45.343869 2021] [authnz_ldap:debug] [pid 195900:tid 140586518488832] mod_authnz_ldap.c(620): [client 195900:900:0065802:062.0620:0620:06201801:01:01:00:00
[Tue Jul 20 21:56:45.343876 2021] [authz_svn:debug] [pid 195900:tid 140586518488832] subversion/mod_authz_svn/mod_authz_svn:/mod_authz_svn_svn/mod_authz_svn:/0:02:02:02:02:01:00:00:00:00:00:00:00:00 local/svn/svn-test/authzsvn.conf
[Tue Jul 20 21:56:45.343905 2021] [authz_svn:info] [pid 195900:tid 140586518488832] [client 192.168.100.120:61050:vchesnserted':vchesnserted':'test:vchess:'Access grants': '' GETss
[Tue Jul 20 21:56:45.343929 2021] [authz_core:debug] [pid 195900:tid 140586518488832] mod_authz_core.c(820): [client 192.160.168.120:60.168.10.120:60.168.120:60.168.20. -users,ou=Groups,dc=my,dc=svn,dc=local: refuzat (niciun utilizator autentificat încă)
[Tue Jul 20 21:56:45.343942 2021] [authz_core:debug] [pid 195900:tid 140586518488832] mod_authz_core.c(820): [client 192.160.168:192.160.168:192.160.120:160.018:160.018:160.018.20. utilizator autentificat încă)
[Tue Jul 20 21:56:45.343946 2021] [authnz_ldap:debug] [pid 195900:tid 140586518488832] mod_authnz_ldap.c(523): [client 192.1 authnz_ldap.c(523): [client 192.1 authnz_ldap:192.1 authn. .100.110/ou=People,dc=my,dc=svn,dc=local?uid
[Tue Jul 20 21:56:45.343953 2021] [authnz_ldap:debug] [pid 195900:tid 140586518488832] mod_authnz_ldap.c(620): [client 195900:60v060202:0620:06201950:00000000000201801:01:01
[Tue Jul 20 21:56:45.343958 2021] [authz_svn:debug] [pid 195900:tid 140586518488832] subversion/mod_authz_svn/mod_authz_svn:/mod_authz_svn_svn/mod_authz_svn:/0:02:02:02:02:01:00:00:00:00:00:00:01 local/svn/svn-test/authzsvn.conf
[Marți, 20 iulie 21:56:45.343961 2021] [authz_svn:info] [pid 195900:tid 140586518488832] [client 192.168.100.120:61050:61050:vgsvtanserted':'test/svgnsvta]
[Tue Jul 20 21:56:45.343974 2021] [authz_core:debug] [pid 195900:tid 140586518488832] mod_authz_core.c(820): [client 192.160.168.192.160.168.20:60.168.120.160.168.120.160.168.20. -users,ou=Groups,dc=my,dc=svn,dc=local: refuzat (niciun utilizator autentificat încă)
[Tue Jul 20 21:56:45.343977 2021] [authz_core:debug] [pid 195900:tid 140586518488832] mod_authz_core.c(820): [client 192.160.168:192.160.168:192.160.120:160.1018:160.018:160.018:160.018:160.018:160.018. utilizator autentificat încă)
[Tue Jul 20 21:56:45.343980 2021] [authnz_ldap:debug] [pid 195900:tid 140586518488832] mod_authnz_ldap.c(523): [client 192.1 authnz_ldap.c(523): [client 192.1 authnz_ldap:192.1 authn. .100.110/ou=People,dc=my,dc=svn,dc=local?uid
[Tue Jul 20 21:56:45.343987 2021] [authnz_ldap:debug] [pid 195900:tid 140586518488832] mod_authnz_ldap.c(620): [client 195900:0v060201:062.0620:06201801:01:03:00:00:00
[Tue Jul 20 21:56:45.343991 2021] [authz_svn:debug] [pid 195900:tid 140586518488832] subversion/mod_authz_svn/mod_authz_svn:/mod_authz_svn_svn/mod_authz_svn:/0:02:02:02:02:01:00:00:00:00:00:00:00 local/svn/svn-test/authzsvn.conf
[Tue Jul 20 21:56:45.343994 2021] [authz_svn:info] [pid 195900:tid 140586518488832] [client 192.168.100.120:61050:61050:vnsvtrunserted':'kvntrunserted':'kvntrunserted':'kvnsvtrunserted
caz 2 error_log
[Marți, 20 iulie 21:57:46.345179 2021] [authz_svn:info] [pid 195900:tid 140586577237760] [client 192.168.100.120:61657: GETnull: -GET] (Acces acordat)
[Tue Jul 20 21:57:46.345227 2021] [authz_core:debug] [pid 195900:tid 140586577237760] mod_authz_core.c(820): [client 192.160.168.192.168.168.27:-60.168.168.20.160.168.20:-60.168.20. -users,ou=Groups,dc=my,dc=svn,dc=local: refuzat (niciun utilizator autentificat încă)
[Tue Jul 20 21:57:46.345231 2021] [authz_core:debug] [pid 195900:tid 140586577237760] mod_authz_core.c(820): [client 192.160.168:192.160.168:192.168.168:160.168:160.168.20:160.168:160.168.120:160.168:160. utilizator autentificat încă)
[Tue Jul 20 21:57:52.242776 2021] [authz_core:debug] [pid 195902:tid 140586619234048] mod_authz_core.c(820): [client 192.160.168:192.168.120.120:6010.168.20:600.168.120:6010.120.20. -users,ou=Groups,dc=my,dc=svn,dc=local: refuzat (niciun utilizator autentificat încă)
[Tue Jul 20 21:57:52.242818 2021] [authz_core:debug] [pid 195902:tid 140586619234048] mod_authz_core.c(820): [client 192.160.168:192.160.118:192.160.120:192.168.10:100.118:100.118.10:100.118.10:100.110.10. utilizator autentificat încă)
[Tue Jul 20 21:57:52.242828 2021] [authnz_ldap:debug] [pid 195902:tid 140586619234048] mod_authnz_ldap.c(523): [client 192.1 authnz_ldap.c(523): [client 192.1 authnz_ldap:192.1 auth. .100.110/ou=People,dc=my,dc=svn,dc=local?uid
[Tue Jul 20 21:57:52.242843 2021] [authnz_ldap:debug] [pid 195902:tid 140586619234048] mod_authnz_ldap.c(620): [client 195902:040486619234048] mod_authnz_ldap.c(620): [client 195902:02:001 authentith0192:01:5:01
[Tue Jul 20 21:57:52.242854 2021] [authz_svn:info] [pid 195902:tid 140586619234048] [client 192.168.100.120:51105:null GET (acces acordat v:null)]
[Tue Jul 20 21:57:52.243059 2021] [authz_core:debug] [pid 195902:tid 140586619234048] mod_authz_core.c(820): [client 192.160.168.10:192.168.10.20:60.168.10.20:600.168.120.120:6010.120.20. -users,ou=Groups,dc=my,dc=svn,dc=local: refuzat (niciun utilizator autentificat încă)
[Tue Jul 20 21:57:52.243069 2021] [authz_core:debug] [pid 195902:tid 140586619234048] mod_authz_core.c(820): [client 192.160.168:192.160.118:192.168.10:192.168.10:100.118.10:100.1010:100.1018:100.1010:100.1010. utilizator autentificat încă)
[Tue Jul 20 21:57:52.243074 2021] [authnz_ldap:debug] [pid 195902:tid 140586619234048] mod_authnz_ldap.c(523): [client 192.1 authnz_ldap.c(523): [client 192.1 authnz_ldap:192.1 auth. .100.110/ou=People,dc=my,dc=svn,dc=local?uid
[Tue Jul 20 21:57:52.243080 2021] [authnz_ldap:debug] [pid 195902:tid 140586619234048] mod_authnz_ldap.c(620): [client 195902:002:001 authentith019234048]
[Tue Jul 20 21:57:52.243104 2021] [authz_svn:debug] [pid 195902:tid 140586619234048] subversion/mod_authz_svn/mod_authz_svn:/mod_authz_svn_svn/mod_authz_svn:/2:02:02:02:02:02:02:01:00:00:00 local/svn/svn-test/authzsvn.conf
[Tue Jul 20 21:57:52.243190 2021] [authz_svn:info] [pid 195902:tid 140586619234048] [client 192.168.100.120:51105:-noches GET-branstedvnuss:-noches GET Access-branstedvnuss:-vntest-vnuchess:-vntest:-vntest
[Tue Jul 20 21:57:52.243215 2021] [authz_core:debug] [pid 195902:tid 140586619234048] mod_authz_core.c(820): [client 192.160.168.10:192.168.120:192.168.120:60.168.120:600.168.10.20. -users,ou=Groups,dc=my,dc=svn,dc=local: refuzat (niciun utilizator autentificat încă)
[Tue Jul 20 21:57:52.243220 2021] [authz_core:debug] [pid 195902:tid 140586619234048] mod_authz_core.c(820): [client 192.160.168:192.160.118:192.160.120:192.168.10:100.118.10:100.1010:100.108.10:100.118:100.1010. utilizator autentificat încă)
[Tue Jul 20 21:57:52.243224 2021] [authnz_ldap:debug] [pid 195902:tid 140586619234048] mod_authnz_ldap.c(523): [client 192.1 authnz_ldap.c(523): [client 192.1 authnz_ldap:192.1 authn. .100.110/ou=People,dc=my,dc=svn,dc=local?uid
[Tue Jul 20 21:57:52.243231 2021] [authnz_ldap:debug] [pid 195902:tid 140586619234048] mod_authnz_ldap.c(620): [client 195902:040486619234048] mod_authnz_ldap.c(620): [client 195902:01:001 authentith0192:01:5:01
[Tue Jul 20 21:57:52.243235 2021] [authz_svn:debug] [pid 195902:tid 140586619234048] subversion/mod_authz_svn/mod_authz_svn:/mod_authz_svn_svn/mod_authz_svn_svn/mod_authz_svn/mod_authz_svn/mod_authz_svn/mod_authz_svn/mod_authz_svn/mod_authz_svn/mod_authz_svn. local/svn/svn-test/authzsvn.conf
[Tue Jul 20 21:57:52.243238 2021] [authz_svn:info] [pid 195902:tid 140586619234048] [client 192.168.100.120:51102:tid 140586619234048] [client 192.168.100.120:51105:-no's GET accesat:'no's GET:-vgt-ttested: 'no's GET
[Tue Jul 20 21:57:52.243248 2021] [authz_core:debug] [pid 195902:tid 140586619234048] mod_authz_core.c(820): [client 192.160.168.10:192.168.10.20:60.168.120:6010.120.120:600.168.20:6010.10.10.20. -users,ou=Groups,dc=my,dc=svn,dc=local: refuzat (niciun utilizator autentificat încă)
[Tue Jul 20 21:57:52.243251 2021] [authz_core:debug] [pid 195902:tid 140586619234048] mod_authz_core.c(820): [client 192.160.168:192.160.118:192.160.120:192.168.20:100.118:100.118:100.118.10:100.1010:100.1010. utilizator autentificat încă)
[Tue Jul 20 21:57:52.243254 2021] [authnz_ldap:debug] [pid 195902:tid 140586619234048] mod_authnz_ldap.c(523): [client 192.1 authnz_ldap:192.1 authn. .100.110/ou=People,dc=my,dc=svn,dc=local?uid
[Tue Jul 20 21:57:52.243261 2021] [authnz_ldap:debug] [pid 195902:tid 140586619234048] mod_authnz_ldap.c(620): [client 195902:02:001 authentith019234048]
[Tue Jul 20 21:57:52.243265 2021] [authz_svn:debug] [pid 195902:tid 140586619234048] subversion/mod_authz_svn/mod_authz_svn:/mod_authz_svn_svn/mod_authz_svn_svn/mod_authz_svn/mod_authz_svn/mod_authz_svn/mod_authz_svn/mod_authz_svn/mod_authz_svn. local/svn/svn-test/authzsvn.conf
[Tue Jul 20 21:57:52.243274 2021] [authz_svn:info] [pid 195902:tid 140586619234048] [client 192.168.100.120:51102:tid 140586619234048] [client 192.168.100.120:511105:-ntrustedvnut:-ntrused:-ntrus]
caz 3 error_log
[Marți, 20 iulie 21:55:55.187406 2021] [authz_svn:info] [pid 195900:tid 140586669557504] [client 192.168.100.120:56967: GETnull: -GET] (Acces acordat)
[Tue Jul 20 21:55:55.187474 2021] [authz_core:debug] [pid 195900:tid 140586669557504] mod_authz_core.c(820): [client 192.16900:tid 140586669557504]. -users,ou=Groups,dc=my,dc=svn,dc=local: refuzat (niciun utilizator autentificat încă)
[Tue Jul 20 21:55:55.187484 2021] [authz_core:debug] [pid 195900:tid 140586669557504] mod_authz_core.c(820): [client 192.160.168:192.160.168:192.160.168:192.160.168:100.168.18:100.169:140586669557504] utilizator autentificat încă)
[Tue Jul 20 21:55:58.763087 2021] [authz_core:debug] [pid 195900:tid 140586635986688] mod_authz_core.c(820): [client 192.160.168.168:192.168.168.120:192.160.168.168:192.168.168.20:600.168.168.120. -users,ou=Groups,dc=my,dc=svn,dc=local: refuzat (niciun utilizator autentificat încă)
[Tue Jul 20 21:55:58.763150 2021] [authz_core:debug] [pid 195900:tid 140586635986688] mod_authz_core.c(820): [client 192.160.168:192.160.168:192.160.168:192.160.168:100.168.120:1060.168:1060.168.20:1060.168.20:1060.168. utilizator autentificat încă)
[Tue Jul 20 21:55:58.763159 2021] [authnz_ldap:debug] [pid 195900:tid 140586635986688] mod_authnz_ldap.c(523): [client 192.9 authnz_ldap.c(523): [client 192.0:1 authnz_ldap. .100.110/ou=People,dc=my,dc=svn,dc=local?uid
[Tue Jul 20 21:55:58.765260 2021] [authnz_ldap:debug] [pid 195900:tid 140586635986688] mod_authnz_ldap.c(561): [client 195900:tid 140586635986688] mod_authnz_ldap.c(561): [client 195900:tid 195900:96682020192. URI /svn/svn-test/ [ldap_simple_bind() pentru a verifica acreditările utilizatorului eșuat][Acreditări nevalide] (nu este autorizat)
[Tue Jul 20 21:55:58.765297 2021] [authn_core:error] [pid 195900:tid 140586635986688] [client 192.168.100.120:56967] AH0017967 de bază: configurat fără modulul corespunzător
