Re: passwd file stores plain text passwords - how to protect it

Den tis 22 aug. 2023 kl 17:53 skrev Bo Berglund <[email protected]>:

> On Tue, 22 Aug 2023 17:38:12 +0200, Bo Berglund <[email protected]>
> wrote:
>
> >On Tue, 22 Aug 2023 13:14:25 +0200, Daniel Sahlberg
> ><[email protected]> wrote:
> >
> >>Please note that for Subversion 1.12 until 1.14 the default was to
> disable
> >>the plaintext password cache. In Subversion 1.15 the plaintext password
> >>cache will again be enabled by default.
>

Subversion 1.15 is not even released yet, so I probably jumped the gun
slightly. I should have said that "Plans are that Subversion 1.15, when
released, will again enable the plaintext password store by default".

>
> >I am using svn a lot on raspberry pi devices and I have now checked the
> current
> >version on one of them:
> >
> >$ svn --version
> >svn, version 1.14.1 (r1886195)
> >   compiled Apr  5 2022, 23:23:59 on arm-unknown-linux-gnueabihf
> >
> >So in order to get back the file cache again I need a version update,
> right?
>

Yes, either from your distribution's repository or build your own from the
current trunk.

Otherwise you can store the unencrypted password using the script linked in
the FAQ entry previosuly mentioned (
https://subversion.apache.org/faq.html#plaintext-passwords).


> >
> >Does anyone know when Debian will move ahead to 1.15?
> >PiOS is based on Debian, so I guess it will be guided by that...
>
>
> >Or is it possible to force a version update via apt?
>
> Forgot to say that PiOS ia version bullseye at the moment...
>

That is a question better directed to the distribution, of course after
Subversion 1.15 is actually released.

Kind regards,
Daniel Sahlberg