Re: CVS and Security

["Aaron D. Turner" <aturner@best.com>]

-----BEGIN PGP SIGNED MESSAGE-----


Check out:

http://freshmeat.net/appindex/1999/05/05/925910532.html

Which is a suid wrapper for CVS's pserver.  Obviously ssh/fshd is a more
secure/better solution, but it requires everyone to use RSA keys (instead
of a password) to authenticate to vodka.  (Note, the RSA keys can be
assigned a password, to protect against unauthorized use, just like PGP
keys can.)

Since I already use RSA keys and ssh/fshd for my CVS I vote for that. :-)


- -- 
Aaron Turner           | Either which way, one half dozen or another. 
aturner@pobox.com      | http://www.pobox.com/~aturner/

"There is no worse tyranny than to make a man pay for something he does
not want merely because you think it would be good for him." 
- -Benjamin Franklin

All emails from this account are PGP signed.  Lack of a signature is "bad".
PGP Key fingerprint = FB E1 CE ED 57 E4 AB 80  59 6E 60 BF 45 1B 20 E8


On Thu, 6 May 1999, Daniel E. Markle wrote:

> I have been reading up on CVS Security and something has become quite
> apparent.  CVS is a gaping security hole.  The pserver method is easily spied
> upon and using rsh, ssh, etc. require all CVS users to have accounts on the
> box, trusting the users to use a secure access method and not rsh.  It looks 
> to me that to really secure CVS we will need to have it on a separate box 
> so that compromises that happen on it don't risk the whole site.  This is more 
> long-term, but something we should probably discuss at some point.  
> 
> At any rate, I don't see any really good way to secure CVS right now,
> short of turning off the pserver method and requiring everyone to use ssh/fsh.
> 
> Do we want to do this?
> 
> -- 
> -------------------
> Daniel E. Markle
> syntax@ashtech.net
> -------------------
> 


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNzHrbzM3jpXy1kJtAQGXVAP9Ghmf84DasDTMHuq0dSdBq6DMsndeY7JT
GPOI3QHLpnip2gaYfxvkRhTgDgPF/bmmnwOoP/gpvYE3QhzPJdIeuWZf6UAEwVjX
dKKWS6PxjWQdtTZ455+QkfmgOqulzdRLsjHUXbHGJQVG7lI2ukl2px7TojV9yfa0
4faZT3X1JyE=
=wgml
-----END PGP SIGNATURE-----