How to grant access to "/.well-known" directory on SVN server (Apache 2.2)

Question

I cannot figure out how to disable authentication for the .well-known directory.

Things behave as expected when I remove the SVN specific directives (DAV, SVNPath, AuthzSVNAccessFile).

<VirtualHost *:443>
  ServerName www.example.com
  DocumentRoot "C:/www.example.com"
  ServerAdmin admin@example.com

  SSLEngine On
  SSLCertificateFile "C:/Apache2/conf/ssl/www.example.com.crt"
  SSLCertificateKeyFile "C:/Apache2/conf/ssl/www.example.com.key"

  <Location />
    DAV svn
    SVNPath "C:/svnrepo"
    SSLRequireSSL 

    AuthName "www.example.com"
    AuthType Basic
    AuthUserFile "conf/svn/svn-users.txt"
    AuthGroupFile "conf/svn/svn-groups.txt"
    AuthzSVNAccessFile "conf/svn/svn-access.txt"

    Require valid-user
  </Location> 

  <Location "/.well-known">    
    Satisfy Any
    Allow from all
    Require all granted
    # Apache 2.4 only
    #AuthType None
  </Location>
</VirtualHost>

Edit: It would also work if I didn't have overlapping paths. E.g. using /svn and /.well-known. Unfortunately that is not something I can change easily now.

The LetsEncrypt probe to `/.well-known/` uses HTTP (80) not HTTPS (443). If you want the SVN on HTTPS-only, as your config suggests, no overlap is needed. That said, per your selfanswer this is now moot. — dave_thompson_085, Feb 16 '19 at 20:36

score 3 · Answer 1 · edited Feb 16 '19 at 18:16

3

You can check apache Directory option. Bellow is a configuration example:

    <Directory /home/html/.well-known/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        Allow from all
    </Directory>

edited Feb 16 '19 at 18:16

SherylHohman

365
1
3
15

answered Apr 10 '17 at 21:22

Amit Vujic

131
5

score 2 · Answer 2 · answered Jul 25 '17 at 09:17

2

in your webroot, create a file .htaccess with the following content:

Options +Indexes

<IfModule mod_rewrite.c>
    RewriteRule "/\.|^\.(?!well-known/)" - [F]
</IfModule>

You need to enable ModRewrite for this to work.

answered Jul 25 '17 at 09:17

Stephan Richter

191
11

score 2 · Answer 3 · answered Feb 16 '19 at 13:58

Just FYI: I eventually decided to bite the bullet and change the path to my svn repo to https://svn.domain.com/repo (instead of using the root).

After so many complications with various systems and frameworks, I decided to follow this pattern for pretty much all hosted applications, namely to always use

subdomain
application context path

e.g. https://subdomain.domain.com/context

This keeps all options open in the future for introducing load balancing, multiple applications below the same domain, multiple applications on the same server etc. And the configurations typically work because there will not be any overlapping paths.

Of course it was painful to switch the svn repo path in all clients.

How to grant access to "/.well-known" directory on SVN server (Apache 2.2)

3 Answers3