Date: Thu, 27 Jul 2000 21:53:19 -0700 (PDT) From: John Polstra <jdp@polstra.com> To: stable@freebsd.org Cc: dwmalone@maths.tcd.ie Subject: Re: rdist and pam Message-ID: <200007280453.VAA25263@vashon.polstra.com> In-Reply-To: <200007271825.aa11185@salmon.maths.tcd.ie> References: <200007271825.aa11185@salmon.maths.tcd.ie>
next in thread | previous in thread | raw e-mail | index | archive | help
In article <200007271825.aa11185@salmon.maths.tcd.ie>, David Malone <dwmalone@maths.tcd.ie> wrote: > Indeed - we did look at it as an option. Cvsup is dead nice, but I > don't think it did what we wanted. > > 1) We already had ssh for authentication and it wasn't > clear if there was a way to get cvsup to use ssh > for authentication. (It's pretty obvious how to > get it to work for transport). So you want to do ssh-style authentication, but not actually tunnel the connection through ssh -- is that what you mean? You can force ssh authentication if you tunnel the connection through it, because you can make the cvsupd server bind only to localhost. But no, ssh authentication standing alone isn't supported currently. (Does _anything_ support that?) I should mention that ssh does support a challenge-response authentication which I believe to be strong. It's not public key, though. It relies on a shared secret. > 2) Cvsupd comes with warnings about not running it as root, > which we'd need to. (We use rdist for cloning /usr > and /usr/local complete with non-world-readable > files). Well, I should tone down that warning, because there is no risk as far as I know. The server definitely can't be made to corrupt any files on its host machine, because it quite simply doesn't open any files for writing. The only possible risk would be if there were a way to trick cvsupd into sending out files which it wasn't configured to send. But it specifically checks for stuff like that and takes care never to send anything from outside its configured area. I have certainly never gotten any reports of exploits. In some ways, cvsupd is safer than rdist or rsync. That's because it's written in Modula-3, which literally makes it impossible to code dangling pointers or stack overflow exploits. They simply cannot be expressed in the language. > 3) I wasn't sure if you can adjust what gets pushed out to > clients from a central config file. We have per > machine exceptions. Actually I am testing just that sort of feature now, in preparation for the next release. :-) > 4) It doesn't read distfiles ;-) Pbltpbltpblt! Rdist doesn't read supfiles. :-) > While I'm thinking of it, I also noticed a problem with cvsup's > GUI. I use tvtwm as a window manager and use ctrl+arrow keys to > move around my desktop. However this doesn't work if the mouse is > pointing into the cvsup window. I presume this is a modula 3 problem, > but I thought you might know what was going on. Yep, it's some strange interaction between some window managers and the M3 graphics library. It's mentioned in the BUGS section of cvsup(1). John -- John Polstra jdp@polstra.com John D. Polstra & Co., Inc. Seattle, Washington USA "Disappointment is a good sign of basic intelligence." -- Chögyam Trungpa To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200007280453.VAA25263>