Re: CVS and Security

[Jason Pincin <jpincin@ashtech.net>]

Very good points here.

Dan, can you investigate what Aaron pointed out here on Freshmeat?  I
don't like the idea of all cvs users needing an account on the box for the
ssh methods.  But maybe we can impliment a cross of these two features?
Using the suid wrapper... and ssh for core developers to secure our own
access.  Thoughts on that?

Also, long term, if we do wish to move dev/cvs off of that box completely
we can migrate it to pluto.  Which may make more sense long term.  That'd
put dev on a completely seperate box with an identical config, as well as
cvs.  Runaway processes would have no impact on the production system, and
we'd have the code base on two different systems, one on the east coast,
one on the west.  

Just a thought.  Obviously nothing we would do now... but down the road a
bit.  Of course it'd be better to just throw a second system in the rack
out there, but I'm not sure how feasible that'd be :)

Jason



On Thu, May 06, 1999 at 12:20:13PM -0700, Aaron D. Turner wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> 
> Check out:
> 
> http://freshmeat.net/appindex/1999/05/05/925910532.html
> 
> Which is a suid wrapper for CVS's pserver.  Obviously ssh/fshd is a more
> secure/better solution, but it requires everyone to use RSA keys (instead
> of a password) to authenticate to vodka.  (Note, the RSA keys can be
> assigned a password, to protect against unauthorized use, just like PGP
> keys can.)
> 
> Since I already use RSA keys and ssh/fshd for my CVS I vote for that. :-)
> 
> 
> - -- 
> Aaron Turner           | Either which way, one half dozen or another. 
> aturner@pobox.com      | http://www.pobox.com/~aturner/
> 
> "There is no worse tyranny than to make a man pay for something he does
> not want merely because you think it would be good for him." 
> - -Benjamin Franklin
> 
> All emails from this account are PGP signed.  Lack of a signature is "bad".
> PGP Key fingerprint = FB E1 CE ED 57 E4 AB 80  59 6E 60 BF 45 1B 20 E8
> 
> 
> On Thu, 6 May 1999, Daniel E. Markle wrote:
> 
> > I have been reading up on CVS Security and something has become quite
> > apparent.  CVS is a gaping security hole.  The pserver method is easily spied
> > upon and using rsh, ssh, etc. require all CVS users to have accounts on the
> > box, trusting the users to use a secure access method and not rsh.  It looks 
> > to me that to really secure CVS we will need to have it on a separate box 
> > so that compromises that happen on it don't risk the whole site.  This is more 
> > long-term, but something we should probably discuss at some point.  
> > 
> > At any rate, I don't see any really good way to secure CVS right now,
> > short of turning off the pserver method and requiring everyone to use ssh/fsh.
> > 
> > Do we want to do this?
> > 
> > -- 
> > -------------------
> > Daniel E. Markle
> > syntax@ashtech.net
> > -------------------
> > 
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.2
> 
> iQCVAwUBNzHrbzM3jpXy1kJtAQGXVAP9Ghmf84DasDTMHuq0dSdBq6DMsndeY7JT
> GPOI3QHLpnip2gaYfxvkRhTgDgPF/bmmnwOoP/gpvYE3QhzPJdIeuWZf6UAEwVjX
> dKKWS6PxjWQdtTZ455+QkfmgOqulzdRLsjHUXbHGJQVG7lI2ukl2px7TojV9yfa0
> 4faZT3X1JyE=
> =wgml
> -----END PGP SIGNATURE-----
---end quoted text---