From owner-freebsd-questions@FreeBSD.ORG Mon Apr 5 03:49:33 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C4C4616A4CE for ; Mon, 5 Apr 2004 03:49:33 -0700 (PDT) Received: from dire.bris.ac.uk (dire.bris.ac.uk [137.222.10.60]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2FECC43D5E for ; Mon, 5 Apr 2004 03:49:33 -0700 (PDT) (envelope-from Jan.Grant@bristol.ac.uk) Received: from mail.ilrt.bris.ac.uk by dire.bris.ac.uk with SMTP-PRIV with ESMTP; Mon, 5 Apr 2004 11:49:25 +0100 Received: from cmjg (helo=localhost) by mail.ilrt.bris.ac.uk with local-esmtp (Exim 3.16 #1) id 1BARef-0003eo-00; Mon, 05 Apr 2004 11:48:37 +0100 Date: Mon, 5 Apr 2004 11:48:37 +0100 (BST) From: Jan Grant X-X-Sender: cmjg@mail.ilrt.bris.ac.uk To: dave In-Reply-To: <000c01c41a92$cf1e3fb0$0200a8c0@satellite> Message-ID: References: <000c01c41a92$cf1e3fb0$0200a8c0@satellite> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: Jan Grant cc: freebsd-questions@freebsd.org Subject: Re: secure cvs server, urgent X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Apr 2004 10:49:33 -0000 On Sun, 4 Apr 2004, dave wrote: > Hello, > I'm wanting to offer cvs services to a select group of users from my > internal server. I need this to be as secure as possible using ssh. I've > tried cvsd, and although it starts when i try to log in, i'm using :pserver: > at the moment, i get the message, premature end of file from server, consult > above messages if any. There are none and nothing in the logs. When i tried > to use the :ext method i got the error: > login can only be used with the pserver method. > If anyone has secure cvs services going behind a firewall to users on > the net please let me know. > Thanks. > Dave. Depends what you mean by "secure". Typical use with ssh is to set CVSROOT=:ext:$USER@server:/path/to/cvs/repo CVS_RSH=ssh in which case the user will need an account on your machine. If you set up public/private key pairs then cvs access from the command line is seamless without requiring "cvs login" (you use ssh-agent to keep your passphrases for you). You can "force" a command line by configuring the user's .ssh/authorized_keys file; you might want to consider setting up a jailed environment for your users with sshd and cvs in it. Even after all that, cvs still has enough mechanisms to permit the execution of arbitrary programs on the server with the user's credentials; so your cvs server still effectively has a high level of trust in your users. If you want something "secure" like this you might want to consider an alternative source control system. Or maybe, if licensing permits, offload that risk to sourceforge, who've got a lot of practice at this sort of thing. -- jan grant, ILRT, University of Bristol. http://www.ilrt.bris.ac.uk/ Tel +44(0)117 9287088 Fax +44 (0)117 9287112 http://ioctl.org/jan/ Personal responsibility for corporate decisions: if they've nothing to hide, they've nothing to lobby against.