Noob questions for SVN checkout and network issues regading it.

Question

We have a local server with SVN installed on it that we are using for development/testing purpouses. We would like to checkout the data from it to the live server that is somewhere out there.

The only way to do that which I thought of was to use "svn checkout" from the live server, right? This way we do not need to FTP the changes to it, that may cause problems is we forget to upload some of the changes. And if we found a problem we can alway go back to previous stable version, right? Correct me if I am wrong about any of these.

The problem is that our local server (Ubuntu) does not have a IP that is reachable from outside. We have a router from out ISP, but we can not use that to access the local server from the live. We are willing to ask the ISP provider to setup a second IP for the local server, but for security sake they want to setup a separate machine with Windows and windows base security software (firewall - http://www.kerio.com/control/ and antivirus) that will cost us a lot. Can we just setup a free firewall on the local server (Ubuntu as I said) and solve the problem without spending additional money?

I hope I was clear.

Answer 1

It's always hard to comment without knowing the exact situation, but this sounds a bit crazy.

What you would usually do is set up port forwarding for one port to the local server. The server would then be reachable (for example) through 123.45.67.89:3690

That's a three-minute task to set up in a normal household router.

As long as the Ubuntu server is closed otherwise, and Subversion or whatever you are using for authentication is properly configured and up to date, this should not create security issues.

In any case, putting a Windows machine in between to act as a firewall sounds really unnecessary. Ubuntu comes with everything necessary to secure the setup properly.

Answer 2

check if your ISP router provide some port forwarding abilities, You should probably forward the ssh port ( after ensuring that everyone password is secure/or enforcing login with ssh keys file), and use SVN+SSH protocol to access your repository.

Answer 3

If the remote server has an ssh server, then you can use ssh forwarding.

From the internal svn server:

ssh -R 7711:localhost:3690 {REMOTE_SERVER}

• 7711 is an arbitrary port (you can use any free port on the remote system) that will be forwarded from the remote system to port 3690 (svn) on the svn server.
• 3690 is the port on the internal svn server that you want to talk to (via svn://).
• If you are using subversion over http:// then use port 80 instead of 3690.
• If you are using subversion over https:// then use port 443 instead of 3690.

After setting up the forward, then you can do this on the remote system:

svn checkout {SCHEME}://localhost:7711/{PATH}

• {SCHEME} is svn, http, https, etc.
• {PATH} is the normal svn path you want to check out.

Notes:

• the forwarded traffic is tunneled through the ssh connection (on a different "channel") so it is also encrypted which is a nice benefit.

• by default, the remote end of the forward will listen on the loopback interface so only processes on that system will be able to use the port forwarded port.

• As soon as you close the ssh session, the forwarded port will also close. It only lasts the duration of the ssh connection.

• ssh forwarding is very powerful. If you can ssh between two systems, then you can get around any sort of connection problem like this.

• Do man ssh and read about the -L and -R options.

• Useful links about ssh forwarding:

  • http://www.rzg.mpg.de/networkservices/ssh-tunnelling-port-forwarding:
  • http://www.walkernews.net/2007/07/21/how-to-setup-ssh-port-forwarding-in-3-minutes/

Answer 4

You should be able to open up and forward a single port (3690 by default) on your existing IP to the local server, as pointed out by Pekka. This depends on your router, and your ability to access the configuration interface on the router.

Instead of having to deal with SSH and worry about people trying to access your local server from anywhere, you could setup a firewall to only allow incoming traffic from your single remote server. Depending on the router setup, you could simply use the builtin firewall on the local server. It would still be advisable to have some svn authentication, though.

The SSH forwarding method described by kanaka prevents the entire issue about remote access to the local machine, but it requires you to execute the forwarding command from the local server every time you need to access svn on the remote server.