NetworkSecure [FreeBSD WIKI]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
===== Description =====

Network operations carried out by the client must be secure.

===== Current Implementation =====

===== SVN Implementation =====

Subversion supports access to remote repositories by tunnelling Subversion's network protocol over ssh (with svn+ssh as the protocol).  If Apache is configured appropriately then Subversion repositories can also be accessed over https.  This can successfully be used via a web proxy.

===== Hg Implementation =====
Hg supports multiple protocols to access repositories.  For developers, the main one is ssh:%%//%% which allows for cloning, pulling and pushing.  HTTP access is R/O by default but Hg now supports R/W through https.

===== Git Implementation =====
Most developers use the git+ssh:%%//%% refspec, which uses ssh as the transport for both fetching and pushing.  Most users use git:%%//%%, which is a custom protocol that isn't secure.  We could export a tree using htt%%%%ps:%%//%%, which would be safe but slow.

This might be an area we would need to improve: provide a gits:%%//%% that was SSLed but also fast like git:%%//%%

===== Monotone Implementation =====
**Supported**
(also see [[http://venge.net/monotone/wiki/FeatureNetworkSecurity|monotone:FeatureNetworkSecurity]])

[[/Monotone|Monotone]]'s netsync protocol uses mutual authentication of client and server keys and has integrity protection, as do the signed revisions and file contents being transferred.  It is recommended that servers use dedicated keys.

It does **not** inherently include confidentiality protection via native encryption (but this can be added via port forwarding through SSH, IPSec, or other suitable means).

Netsync also supports a direct ssh transport where a user has personal databases on two machines and ssh accounts and access between them; this is not scalable to many users as accessing a database via ''%%ssh://%%'' locks it, while the same database can be accessed by many netsync users concurrently.

----

{{tag>Stale}}