> > A chroot environment is only good at containing > > what's inside it. It > > does not prevent access to the chroot environment > > from outside. > > I see. I guess it's obvious that the repository would > have to be within the chroot'ed environment meaning > that such an environment wouldn't help in preventing > users from directly accessing the archive files. Is > this right?
Yes, this you are correct... chrooting a file system would have no impact on the user's ability to access the repository. The best method for keeping folks out is to use public key ssh auth, constrain user's key to exactly one command required for cvs, and to disable passwd authentication-- both on the ssh and os level. >From this point you can use unix file and group security to further control what can be written/read. I've not set up cvs readers/writers, but that may add an additional layer. Finally, you can implement a commit hook to further filter by module and or branch. _______________________________________________ Info-cvs mailing list [EMAIL PROTECTED] http://mail.gnu.org/mailman/listinfo/info-cvs
