Skip to main content
protocols.pageprotocols.page
3690

Port 3690 – SVN

TCP

Port 3690 is the Subversion (SVN) native protocol port served by svnserve. The svn:// protocol on port 3690 supports SASL authentication but no encryption by default. For secure access, use svn+ssh:// (tunneled through SSH) or SVN over HTTPS (Apache mod_dav_svn on port 443). Most teams have migrated to Git.

Port Number

3690

Protocol

TCP

Service

Subversion (svnserve)

Range

IANA Registered (1024–49151)

Description

Subversion's native protocol (svnserve) on port 3690 provides repository access without requiring a web server. It supports anonymous read access, SASL-based authentication (CRAM-MD5, DIGEST-MD5), and authz-based path authorization. The svn:// protocol on port 3690 does not encrypt traffic by default – repository contents and diffs travel in cleartext. SASL can negotiate encryption but many deployments skip this configuration. For any production SVN deployment, prefer svn+ssh:// which tunnels everything through SSH, or Apache with mod_dav_svn over HTTPS. Port 3690 is primarily relevant for legacy systems – Git has replaced SVN in most organizations.

Security risks

  • 1CVE-2017-9800: Subversion svn:// client arbitrary code execution – malicious SVN server name containing shell metacharacters executes commands on the client (CVSS 9.8)
  • 2No encryption: svnserve on port 3690 transmits all source code, credentials, and repository operations in cleartext. Code diffs and commit messages visible to network sniffers
  • 3Plaintext password storage: svnserve's built-in auth stores passwords in plaintext (/conf/passwd in the repo). SASL support exists but is rarely configured
  • 4Repository enumeration: connecting to port 3690 without specifying a repo often reveals all available repository names on the server
  • 5Legacy protocol with declining security attention: SVN development focuses on stability, not new security features. The protocol receives minimal security research compared to Git

Firewall guidance

Strongly prefer svn+ssh:// (port 22, encrypted, key-based auth) or https:// (port 443, Apache mod_dav_svn with LDAP/AD auth). If svnserve must run on 3690: restrict to internal developer subnets only, configure SASL for authentication, and consider stunnel wrapper for TLS. Better yet: migrate to Git.

Diagnosis commands

Test svnserve connectivity and repo access

shell
svn info svn://server/repo

Brute-force SVN authentication (security audit)

shell
nmap -p 3690 --script svn-brute target

Review svnserve configuration (auth, access control)

shell
cat /path/to/repo/conf/svnserve.conf | grep -v '#'

Check if svnserve is running

shell
ss -tlnp | grep 3690

Usage examples

Port 3690 – SVN
shell
svn checkout svn://server/repo/trunk
svnserve -d --root /var/svn
svn info svn://server/repo

Common services on this port

svnserve (standalone SVN server)Apache mod_dav_svn (over HTTP/S)VisualSVN Server (Windows)

Related ports

3690

svnserve (this port, unencrypted)

22

svn+ssh (SVN over SSH tunnel)

443

SVN over HTTPS (Apache mod_dav_svn)

History

Subversion (SVN) was created by CollabNet in 2000 as a replacement for CVS. Port 3690 was assigned for the svnserve native protocol. SVN dominated version control from 2004-2012 before Git's rise. svnserve was designed for simplicity (no web server needed) but lacks encryption. Apache mod_dav_svn (over HTTPS) became the recommended production deployment. Many organizations still maintain SVN repositories for legacy projects alongside Git.

FAQ

Should I migrate from SVN to Git?

Yes, unless you have specific SVN-only requirements (giant binary files with locking, path-based authorization per-directory). Migration tools: git-svn (preserves history), svn2git (Ruby, cleaner), or SubGit (commercial, bidirectional mirror during transition). Largest pain points: SVN's path-based authz doesn't map to Git (use GitLab/GitHub CODEOWNERS instead), and SVN externals need Git submodules or subtrees.

How do I secure an existing svnserve deployment?

1. Switch to svn+ssh:// (just change URL scheme, uses SSH keys, no port 3690 needed). 2. If svnserve must run: enable SASL in svnserve.conf (use-sasl = true, configure /etc/sasl2/svn.conf with mechanisms like DIGEST-MD5). 3. Wrap in stunnel for TLS. 4. Set anon-access = none in svnserve.conf. 5. Move passwords out of plaintext /conf/passwd into SASL/LDAP backend.

Specification

RFC 3253 – Port 3690 specification →