Subversion using SSPI HTTP module versus HTTPS

I am updating our svn server and want to switch to windows authentication instead of htpassword files. I installed the module and can run it on HTTP or HTTPS .

Accessing repositories using TortoiseSVN , I have 2 scenarios:

  • Access SSPI + HTTPS settings . Login automatically and works like a charm :)

  • Access to SSPI + HTTP settings . Logging in requires entering the username and password of my domain in TortoiseSVN, which is normal since I can ask TortoiseSVN to remember my credentials.

My questions:

If I use SSPI + HTTP instead of SSPI + HTTPS , is my password and username then encrypted?

The reason I ask is because we are on the local network and will never be able to access from the outside, and SSL is superfluous because it makes everything pretty slow: S. Therefore, I would prefer to use HTTP + SSPI.

I searched my password on the network using WireShark and no luck, which would mean that the credentials are really encrypted :). I could only find the line I suspect is my user password, which looks something like this: Authorization: Basic Yh2_3 m% erTo_d4fre

- , , , SSPI + HTTP, :).

Garrett

********************** EDIT ************** ********

, - . , , :):

svn, SSPI + HTTP , SSPI Basic Auth , SSPI SSL. , mild Basic Auth , SSL.

, SSPI , , + Basic Auth, , ( , )..

, . - , ?

+3
1

UPDATE. Subversion 1.8.0: Subversion SPNEGO/NTLM, . http-auth-types negotiate;ntlm;basic

Subversion Negotiate/NTLM HTTPS.

VisualSVN Server KB, / Subversion: http://www.visualsvn.com/support/topic/00040/

"--" NTLM/Negotiate HTTP. .

HTTP, Subversion. NTLM/ HTTP http-auth-types Subversion. : "http-auth-types = basic". NTLM/Negotiate, "http-auth-types = basic, negotiate".

Subversion.

+3

Source: https://habr.com/ru/post/1779785/


All Articles