[ On Tuesday, July 27, 2004 at 03:00:52 (+0900), Chiaki wrote: ]
> Subject: CVS woes: .cvspass
>
> The file revision control system, CVS,
> stores often used server's password in
> users .cvspass file. (When we use pserver mode to set up a
> central repository and access it from remote workstations,
> that is.)
Anyone using the CVS pserver mechanism for anything other than totally
anonymous access gets only what they deserve.
If you want to keep your CVS repository secure then don't try to use CVS
as a security tool -- it wasn't designed for it, and it cannot be
"fixed" either (it's not a bug -- CVS is a version control tool, not a
security tool and CVS is designed _only_ to be executed by the unique
user performing operations on repository).
Use SSH or some other secure remote job execution tool to create a
secure connection for CVS to work with.
--
Greg A. Woods
+1 416 218-0098 VE3TCP RoboHack <woods (at) robohack (dot) ca [email concealed]>
Planix, Inc. <woods (at) planix (dot) com [email concealed]> Secrets of the Weird <woods (at) weird (dot) com [email concealed]>
> Subject: CVS woes: .cvspass
>
> The file revision control system, CVS,
> stores often used server's password in
> users .cvspass file. (When we use pserver mode to set up a
> central repository and access it from remote workstations,
> that is.)
Anyone using the CVS pserver mechanism for anything other than totally
anonymous access gets only what they deserve.
If you want to keep your CVS repository secure then don't try to use CVS
as a security tool -- it wasn't designed for it, and it cannot be
"fixed" either (it's not a bug -- CVS is a version control tool, not a
security tool and CVS is designed _only_ to be executed by the unique
user performing operations on repository).
Use SSH or some other secure remote job execution tool to create a
secure connection for CVS to work with.
--
Greg A. Woods
+1 416 218-0098 VE3TCP RoboHack <woods (at) robohack (dot) ca [email concealed]>
Planix, Inc. <woods (at) planix (dot) com [email concealed]> Secrets of the Weird <woods (at) weird (dot) com [email concealed]>
[ reply ]