---------- Forwarded message ---------- Date: Sat Jun 12 05:59:08 GMT 1999 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Received: from ux(204.181.176.2) by ux(smtpd 2.1.2) with SMTP id smtp006180; Sat, 12 Jun 99 00:58:43 -0500 On Fri, 11 Jun 1999 14:24:44 -0700 Bradford Hull <[EMAIL PROTECTED]> wrote: > All right, I'll bite. What exactly is it about using ssh to give > cvs connection that is insecure? You can control which users are > able to access the repository, because you only allow the ones you > want to set up authorization to connect to your system with ssh; > and all data is transferred with encryption and good > authentication. This is more secure than any other way of giving > people access to a code base than any other method I have ever > heard of. It is not secure to the extent that CVS'es pserver is not secure. It is effectively tantamount to granting those users shell access to the server with a reasonable probability that they may be able to exploit that shell access into root access (given that pserver runs as root and was not designed or built with security in mind). > Is there a hole I don't see, or a better method available? As I mentioned previously, we're very happy with BitKeeper. Yes, you're still granting shell access to the host containing the source repositories, but you have the advantage that there are no server daemons running as root or other proviledged users. -- J C Lawrence Internet: [EMAIL PROTECTED] ----------(*) Internet: [EMAIL PROTECTED] ...Honorary Member of Clan McFud -- Teamer's Avenging Monolith...
