Re: Multiple CVS and same files

2001-05-30 Thread Harald Kucharek



Erik Mattsson wrote:
 
 HI
 
 Im wondering if it is possible for different CVS's to share some files ?
 Im in a project that has two CVS, because they are mainly two
 different projects. But in these two projects we do have some
 common files that are used in both projects, and it would be nice
 if those files just could be one instance.
 
 The problem now is when we update a file in a CVS we must
 also edit the other file in the other CVS to update so the file
 looks the same. This can be tedious and very errorprone so it
 would nice to share the same file in the two CVS's, and just update
 one instance of it, and both CVS would have the new file.
 
 If you still dont get it :
 Imagine the following layout of a CVS:
 
 cvsA/xml
 cvsA/applecode
 
 cvsB/xml
 cvsB/orangecode
 
 the */xml contains the same files but are needed in both projects. Is
 it possible to update the cvsA/xml so the cvsB/xml also gets updated ?
 
 Any ideas or suggestions ?
 
 //Erik
 

Well, I guess life wouldn't be the same after working with two repositories which
share some directories...
You should use one repository and modules to achieve what you want.

Harald

PS: If I'm not mistaken, except for race conditions etc it should be possible to
do what you asked for, because the ,v files in the repo don't contain information
about which repo they are in. But you are always in danger two people are changing
the same file in what looks like to be two different files in different 
repositories.

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



just a note

2001-05-30 Thread dragon20


PLEASE FORWARD TO THE PERSON
RESPONSIBLE FOR PURCHASING
YOUR LASER PRINTER SUPPLIES

 VORTEX  SUPPLIES 

LASER PRINTER TONER CARTRIDGES,
COPIER AND FAX CARTRIDGES

SAVE UP TO 30% FROM RETAIL

ORDER BY PHONE:1-888-288-9043
ORDER BY FAX: 1-888-977-1577
CUSTOMER SERVICE: 1-888-248-2015
E-MAIL REMOVAL LINE: 1-888-248-4930 

UNIVERSITY AND/OR SCHOOL PURCHASE ORDERS WELCOME. (NO CREDIT APPROVAL REQUIRED)
ALL OTHER PURCHASE ORDER REQUESTS REQUIRE CREDIT APPROVAL.
PAY BY CHECK (C.O.D), CREDIT CARD OR PURCHASE ORDER (NET 30 DAYS).

IF YOUR ORDER IS BY CREDIT CARD PLEASE LEAVE YOUR CREDIT CARD # PLUS EXPIRATION DATE. 
IF YOUR ORDER IS BY PURCHASE ORDER LEAVE YOUR SHIPPING/BILLING ADDRESSES AND YOUR P.O. 
NUMBER


FOR THOSE OF YOU WHO REQUIRE MORE INFORMATION ABOUT OUR COMPANY
INCUDING FEDERAL TAX ID NUMBER, CLOSEST SHIPPING OR CORPORATE ADDRESS IN THE 
CONTINENTAL 
U.S. OR  FOR CATALOG  REQUESTS PLEASE CALL OUR CUSTOMER SERVICE LINE  1-888-248-2015 
 

OUR NEW , LASER PRINTER TONER CARTRIDGE, PRICES ARE  AS FOLLOWS: 
(PLEASE ORDER BY PAGE NUMBER AND/OR ITEM NUMBER)

HEWLETT PACKARD: (ON PAGE 2)

ITEM #1  LASERJET SERIES  4L,4P (74A)$44
ITEM #2  LASERJET SERIES  1100 (92A)-$44
ITEM #3  LASERJET SERIES  2 (95A)$39
ITEM #4  LASERJET SERIES  2P (75A)---$54 
ITEM #5  LASERJET SERIES  5P,6P,5MP, 6MP (3903A)--  -$44
ITEM #6  LASERJET SERIES  5SI, 8000 (09A)$95
ITEM #7  LASERJET SERIES  2100 (96A)-$74
ITEM #8  LASERJET SERIES  8100 (82X)$145
ITEM #9  LASERJET SERIES  5L/6L (3906A)--$39
ITEM #10 LASERJET SERIES  4V-$95
ITEM #11 LASERJET SERIES 4000 (27X)--$72
ITEM #12 LASERJET SERIES 3SI/4SI (91A)---$54
ITEM #13 LASERJET SERIES 4, 4M, 5,5M-$49
ITEM #13A LASERJET SERIES 5000 (29X)-$95

HEWLETT PACKARD FAX (ON PAGE 2)

ITEM #14 LASERFAX 500, 700 (FX1)--$49
ITEM #15  LASERFAX 5000,7000 (FX2)$54
ITEM #16  LASERFAX (FX3)--$59
ITEM #17  LASERFAX (FX4)--$54


LEXMARK/IBM (ON PAGE 3)

OPTRA 4019, 4029 HIGH YIELD---$89
OPTRA R, 4039, 4049 HIGH YIELD---$105

OPTRA E---$59
OPTRA N--$115
OPTRA S--$165


EPSON (ON PAGE 4)

ACTION LASER 7000,7500,8000,9000--$105
ACTION LASER 1000,1500$105


CANON PRINTERS (ON PAGE 5)

PLEASE CALL FOR MODELS AND UPDATED PRICES
FOR CANON PRINTER CARTRIDGES

PANASONIC (0N PAGE 7)

NEC SERIES 2 MODELS 90 AND 95--$105

APPLE (0N PAGE 8)

LASER WRITER PRO 600 or 16/600--$49 
LASER WRITER SELECT 300,320,360-$74
LASER WRITER 300 AND 320$54
LASER WRITER NT, 2NT$54
LASER WRITER 12/640-$79

CANON FAX (ON PAGE 9)

LASERCLASS 4000 (FX3)---$59
LASERCLASS 5000,6000,7000 (FX2)-$54
LASERFAX 5000,7000 (FX2)$54
LASERFAX 8500,9000 (FX4)$54

CANON COPIERS (PAGE 10)

PC 3, 6RE, 7 AND 11 (A30)-$69
PC 300,320,700,720 and 760 (E-40)-$89

IF YOUR CARTRIDGE IS NOT LISTED CALL CUSTOMER SERVICE AT 1-888-248-2015 

90 DAY UNLIMITED WARRANTY INCLUDED ON ALL PRODUCTS.

ALL TRADEMARKS AND BRAND NAMES LISTED ABOVE ARE PROPERTY OF THE 
RESPECTIVE HOLDERS AND USED FOR DESCRIPTIVE PURPOSES ONLY.








___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



Re: cvs add filename error

2001-05-30 Thread Matthew Riechers


sandra humphrey wrote:
 
 I am trying to add a new file to a repository with the following
 command:
 cvs add filename.  It is returning the error:
 cvs add win.ini
 cvs add: in directory .:
 cvs [add aborted]: there is no version here; do 'cvs checkout' first
 
 This is a brand new repository and a new file.

Are you in a checked-out working directory? cvs looks for info in the
CVS directory located in your current directory. If you haven't already,
you need to do a checkout before anything else...

-Matt

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



CVS training

2001-05-30 Thread Santimore, Matt

Anybody out there provide  end user and operational training for CVS?

TIA

Matt

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



Re: Linux security issues as they pertain to CVS

2001-05-30 Thread Derek R. Price

Greg A. Woods wrote:

 [ On Tuesday, May 29, 2001 at 09:18:33 (-0500), Thornley, David wrote: ]
  Subject: RE: Linux security issues as they pertain to CVS
 
  Any problems with running pserver over an encrypted channel?  It seems to
  met that would be just as secure as ssh access (and, of course, just as
  unsafe - the biggest potential security problems being the guys on both
  ends of the channel).

 That more or less defeats the purpose since you usually have to have a
 real identity to establish a secure channel connection to a server in
 the first place so why not just use that channel for remote job
 execution?  (unless you're talking about an IPsec VPN tunnel, but then
 you've got different issues to worry about)

No you don't.  A secure channel only need authenticate the server, possibly
using an external certificate authority, a la HTTPS.


 CVS pserver on the other hand is under the full and direct control of
 the (or rather *any*) user at the other end so you cannot transfer your
 trust to the client CVS program and you cannot be sure that the person
 at the remote keyboard really is the same joe -- there's no secure
 link between the authentication done by the remote client computer to
 allow that user to access it and whatever might be claimed over the
 pserver channel.  Therefore pserver even over a secure channel is not
 itself secure.

Which is perfectly fine and possibly even desirable when you, as CVS
administrator, have no control over the client machine anyhow.  If I have root
access on the client I could use any login I wished anyhow.  In other words,
you'd rather know I knew the password you gave me.

In this case the secure channel should protect you from password sniffers.

Derek

--
Derek Price  CVS Solutions Architect ( http://CVSHome.org )
mailto:[EMAIL PROTECTED] CollabNet ( http://collab.net )
--
Cynic:  Someone who smells the flowers and looks for the casket




___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



Re: Release notes out of CVS

2001-05-30 Thread Todd Denniston

Anette Van Aswegen wrote:
 
 Hi
 
 I would like to know whether there a facility exists within CVS from where I
 can retrieve a release note after we have released
 a new version. 

`cvs log` and `cvs history`

try http://www.red-bean.com/cvs2cl/ to get the notes down to a manageable list.

 How would CVS know which version was released to a client?

CVS does not by itself, however you can use branches and/or tags against the
whole baseline to make it appear so to the human operator.
http://cvshome.org/docs/manual/cvs_4.html#SEC48
http://cvshome.org/docs/manual/cvs.html
http://cvshome.org/docs/manual/cvs_14.html#SEC111

 
 Thank you
 
 Anette van Aswegen

-- 
__
I'd crawl over an acre of 'Visual This++' and 'Integrated Development
That' to get to gcc, Emacs, and gdb.  Thank you.
-- Vance Petree, Virginia Power

The opinions expressed here are not sanctioned by and do not necessarily 
represent those of my employer.



Re: [Newbie question] When LOGIN fails

2001-05-30 Thread Derek R. Price

David A. Cobb wrote:

 Today I was working with a repository at the other end of an SSH tunnel.

 My CVS LOGIN was rejected: server denied access to ${CVSROOT}

 However, while experimenting with Xemacs/PCL-CVS I requested to STATUS,
 and then to UPDATE my directories.  Both functions apparently worked.

 Does this indicate that the login only applies to a comit?
 Is this by design, or is it a big security hole?

No.  You were most likely using different logins/passwords/roots somehow for the
different cases you describe above.

Derek

--
Derek Price  CVS Solutions Architect ( http://CVSHome.org )
mailto:[EMAIL PROTECTED] CollabNet ( http://collab.net )
--
151.  H lp!  S m b dy st l   ll th  v w ls fr m my k yb  rd!




___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



How to compile a static CVS

2001-05-30 Thread Mark


Hello,

I have seen posts able have a static CVS binary. How does one
create it? Is there a special option to configure or the coimpiler
or is it done by default? I am using sun workshop 6.1 on solaris
2.6.

Thanks,

Mark

__
Do You Yahoo!?
Get personalized email addresses from Yahoo! Mail - only $35 
a year!  http://personal.mail.yahoo.com/

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



cannot check out project

2001-05-30 Thread Kini, Nagraj (GEAE, Foreign National)

 Hello,
   This bug has been posted at lot of different places but i did not
 seen to get a solution for it.
  when i try to check out
 i get the message
 cvs server: Updating gpack
 cvs server: failed to create lock directory in repository
 `/cvsroot/gpack/gpack': Permission denied
 cvs server: failed to obtain dir lock in repository `/cvsroot/gpack/gpack'
 cvs [server aborted]: read lock failed - giving up
 
 but all the other team members seem to do it just fine.
 Please help,
 Thanks,
 Nagraj.
 

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



RE: cannot check out project

2001-05-30 Thread Helliwell, Matthew


 Hello,
   This bug has been posted at lot of different places but i did not
 seen to get a solution for it.
  when i try to check out
 i get the message
 cvs server: Updating gpack
 cvs server: failed to create lock directory in repository
 `/cvsroot/gpack/gpack': Permission denied
 cvs server: failed to obtain dir lock in repository `/cvsroot/gpack/gpack'
 cvs [server aborted]: read lock failed - giving up

I don't know about the cvs server side but we get that error when the user
does not have permission to write to the directory. Have you checked the
permissions set on /cvsroot/gpack/gpack?

-- 
Matt


--
If you have received this e-mail in error or wish to read our e-mail 
disclaimer statement and monitoring policy, please refer to 
http://www.drkw.com/disc/email/ or contact the sender.
--

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



Re: cannot check out project

2001-05-30 Thread Donald Sharp

What are the directory permissions in /cvsroot/gpack/gpack?

Are you allowed to write in there?

doinald
On Wed, May 30, 2001 at 10:04:48AM -0400, Kini, Nagraj (GEAE, Foreign National) wrote:
  Hello,
  This bug has been posted at lot of different places but i did not
  seen to get a solution for it.
   when i try to check out
  i get the message
  cvs server: Updating gpack
  cvs server: failed to create lock directory in repository
  `/cvsroot/gpack/gpack': Permission denied
  cvs server: failed to obtain dir lock in repository `/cvsroot/gpack/gpack'
  cvs [server aborted]: read lock failed - giving up
  
  but all the other team members seem to do it just fine.
  Please help,
  Thanks,
  Nagraj.
  
 
 ___
 Info-cvs mailing list
 [EMAIL PROTECTED]
 http://mail.gnu.org/mailman/listinfo/info-cvs

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



Re: safe to delete directories manually

2001-05-30 Thread Matthew Riechers


Rich Smith wrote:
 
 Is it safe to delete directories in the CVS repository manually. We have
 some directories that were created in the wrong place in the directory tree.
 I would like to remove them so that they don't clutter up the browsing of
 the repository (via cvsweb). Is this safe to do?

You can delete a directory w/o messing up the repository. Everything
important to repository integrity is maintained at the file level (,v
files) and in CVSROOT. This will have an impact on working directories,
so the best thing to do is either move the files and log them via the
usual add/remove, or disable commits to the repository while you do the
move, and let everyone update afterward.

-Matt

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



Re: safe to delete directories manually

2001-05-30 Thread Larry Jones

Rich Smith writes:
 
 Is it safe to delete directories in the CVS repository manually. We have
 some directories that were created in the wrong place in the directory tree.
 I would like to remove them so that they don't clutter up the browsing of
 the repository (via cvsweb). Is this safe to do?

Yes.

-Larry Jones

I can feel my brain beginning to atrophy already. -- Calvin

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



cvs log and date ranges

2001-05-30 Thread Zachary M. Smith

I am trying to use 'cvs log' to show me the log entries for files
that changed between two dates.  So, for example, I run the following
command:

cvs log -d'05/29/2001 03:0105/29/2001 12:06'

which I would expect to show me the logs for all the files changed between
3:01am and 12:06pm on May 29.

i've also tried the folowing:

cvs log -d'2001-05-29 03:012001-05-29 12:06'

but what i get is *all* of the changes.  i am not getting a range.

Now, what I'd really like to do is pass log to tags and find the differences
between those, but I have not seen any info on how to do that so i'm trying
to make due with dates.

Any help is appreciated.

-zach

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



problem after login

2001-05-30 Thread Robert Koberg

I am using pserver to connect to login to the repository.  On the local
linux machine everything is fine. When I try to access it remotely I can log
in and it authenticates me (I assume since there is no error msg and I am
back at the prompt).

But when I try to to check something out I get the error (the remote machine
is 192.168.1.102 -  the cvs machine is 192.168.1.101):
 192.168.1.102:connection refused
cvs [checkout aborted]: end of file from server (consult above message if
any)

can anyone tell me how to fix this?  I have not seen this error in any FAQ
and I believe I have followed instructions...





___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



Re: cvs log and date ranges

2001-05-30 Thread Larry Jones

Zachary M. Smith writes:
 
 I am trying to use 'cvs log' to show me the log entries for files
 that changed between two dates.  So, for example, I run the following
 command:
 
 cvs log -d'05/29/2001 03:0105/29/2001 12:06'

 which I would expect to show me the logs for all the files changed between
 3:01am and 12:06pm on May 29.

Actually, that should show you the log messages after 12:06pm and before
3:01am (local time) on May 29 -- you want , not .  Note that it
always shows the headers for all of the files, but limits the log
messages to just those in the range you specify.

 Now, what I'd really like to do is pass log to tags and find the differences
 between those, but I have not seen any info on how to do that so i'm trying
 to make due with dates.

http://cvshome.org/docs/manual/cvs_16.html#SEC141

cvs log -rtag1:tag2

-Larry Jones

If I get a bad grade, it'll be YOUR fault for not doing the work for me!
-- Calvin

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



Re: problem after login

2001-05-30 Thread Larry Jones

Robert Koberg writes:
 
 But when I try to to check something out I get the error (the remote machine
 is 192.168.1.102 -  the cvs machine is 192.168.1.101):
  192.168.1.102:connection refused
 cvs [checkout aborted]: end of file from server (consult above message if
 any)

Connection refused means that there's nothing listening at the
cvspserver port on the server machine.  Either some went wrong with
inetd between the time you logged in and the time you tried the
checkout, someone else changed its configuration, or you logged in to a
different machine than you tried to check out from.

-Larry Jones

I don't see why some people even HAVE cars. -- Calvin

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



cvs edit: dying gasps

2001-05-30 Thread Bina Kshatriya

If there is a watch set on a file and I try to use
cvs edit filename to edit the file, I get an error
message: cvs edit: dying gasps from the respository
host.  The weird part is that I have used watches
before and did not receive this error message.  

__
Do You Yahoo!?
Get personalized email addresses from Yahoo! Mail - only $35 
a year!  http://personal.mail.yahoo.com/

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



Re: question about cvs!

2001-05-30 Thread wangc

I have downloaded a version of cvs for solaris 2.5.1 and now it works
Thanks,
wangc


- Original Message - 
From: Donald Sharp [EMAIL PROTECTED]
To: wangc [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Sent: Tuesday, May 29, 2001 9:40 PM
Subject: Re: question about cvs!


 Your using a version of cvs that is compiled for a later version( 2.6,2.8? )
 of solaris than what you are using.
 
 Get the source and compile.
 
 donald
 On Tue, May 29, 2001 at 10:51:44AM +0800, wangc wrote:
  hi,
  I just want to use cvs for a project's version control.And now
  I have installed the cvs1.11p1 on a sun workstation(Solaris 2.5.1) as
  cvs server and Wincvs on my PC(win98) as a client.But there are some 
  errs.The Wincvs show this hint :
  
  ld.so.1: cvs: fatal: relocation error: symbol not found: setsockopt: referenced in 
cvs
  
  I dont know the reason!
  
  Thanks for your help!
  
  
 
ú¾ÉšŠX§‚X¬´‰ß¡Ëì‚{¨®m¶Ÿÿ™¨¥‚{¨®æj)fjåŠËbú?Šwèrû


Re: Linux security issues as they pertain to CVS

2001-05-30 Thread Greg A. Woods

[ On Wednesday, May 30, 2001 at 09:23:20 (-0400), Derek R. Price wrote: ]
 Subject: Re: Linux security issues as they pertain to CVS

 No you don't.  A secure channel only need authenticate the server, possibly
 using an external certificate authority, a la HTTPS.

You cannot have a secure channel without some form of authentication.

HTTPS alone does not give you a secure channel.  It might give you a
secret channel, but unless you know an awful lot more about certificates
and SSL than the average person then you do not have any clue as to even
who's machine is on the other end.  Even worse it doesn't tell the
server which *user* is responsible for opening the channel.

That's why I suggested using rsh over an IPsec VPN tunnel.  You could do
the same over an SSH tunnel.  The assumptions of who you have to trust
are more or less the same.

 Which is perfectly fine and possibly even desirable when you, as CVS
 administrator, have no control over the client machine anyhow.  If I have root
 access on the client I could use any login I wished anyhow.  In other words,
 you'd rather know I knew the password you gave me.
 
 In this case the secure channel should protect you from password sniffers.

I think you're focusing on some (admittedly important) details without
looking at the whole picture.  You cannot have security if you don't
cover *all* of your bases equally!  You also must understand the
inherent limitations and assumptions built into your client and server
platforms so that you can establish a true trust path that'll make it
possible for you to hold your users accountable for their actions.

-- 
Greg A. Woods

+1 416 218-0098  VE3TCP  [EMAIL PROTECTED] [EMAIL PROTECTED]
Planix, Inc. [EMAIL PROTECTED];   Secrets of the Weird [EMAIL PROTECTED]

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



Re: CVS SSL

2001-05-30 Thread Greg A. Woods

[ On Thursday, May 24, 2001 at 15:26:17 (-0400), Derek R. Price wrote: ]
 Subject: Re: CVS  SSL

 By limiting CVS to :ext: you are limiting the choice of security models to those
 which provide _shell_accounts_on_the_server_!  The socket provider model allows for
 any sort of security model that can provide a tcp connection and uses its own methods
 to determine user names for the logs.  As for the security of the pserver auth for
 log names, well, yeah, it's fairly insecure.  An appropriate and backwards compatible
 upgrade for this might be something like PAM.  Of course that probably doesn't work
 for all platforms.  I believe Alexey Mahotkin did this for nserver already, so we
 might see it in CVS if his code ever makes it into a mergable state.  His recent
 questions lead me to believe he is at least updating his changes to work with
 1.11...  :)

You've missed a *HUGE* hole in your argument.

By allowing *anyone* to use CVS on your machine you are very nearly
granting them shell access anyway!  If you do so in a totally
unaccountable way (i.e. with pserver) then you've just lost the
integrity (and thus the security) of your repository.

I.e. CVS cannot guarantee that it will not allow a remote user to
execute any arbitrary command (and indeed maybe even any arbitrary code
whatsoever).  There is no inherent security in CVS -- anyone who can
execute it can probably do anything as the user it executes as.

If you want to set up a repository that's owned and accessible by a
pseudo-user to which any number of other real-world people may be
authenticated and authorised to use, then that's your business.  However
any claim that such a repository is secure is bogus.  All you've done is
created a shared account which owns the repository and thus you have no
real accoutability whatsoever.  Anyone can change the repository (or
anything else on the system owned by the same user and at the same time
they can probably even mis-direct blame to any other user with access to
the shared account.  It's not as bad as giving everyone the root
password, but it's not much better from the point of view of anyone
concerned with the integrity of the repositoyr.

What's even worse is the scenario where some poor fool runs CVS as root
with only pserver passwords.  The result there is that he's effectively
turned all the accounts mapped by pserver into a common pool of shared
accounts!  Anyone can possibly be anyone else and do anything!  All
accountability is totally gone out the window, especially since the
average naive admin who doesn't understand this issue will easily be
mis-directed into placing any blame on an innocent party!

I.e. pserver alone is rather stupid (because it's really not necessary),
but pserver started as root with setuid to other users is down right
evil.

-- 
Greg A. Woods

+1 416 218-0098  VE3TCP  [EMAIL PROTECTED] [EMAIL PROTECTED]
Planix, Inc. [EMAIL PROTECTED];   Secrets of the Weird [EMAIL PROTECTED]

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs



Re: CVS SSL

2001-05-30 Thread Greg A. Woods

[ On Thursday, May 24, 2001 at 15:26:17 (-0400), Derek R. Price wrote: ]
 Subject: Re: CVS  SSL

  Maybe I need to ask for people to help me to produce a new release of
  CVS based on my current private work so that a safe alternative
  implementation is publicly available.
 
 If you have this much time on your hands for this sort of thing,
 please work _with_ us.  Few enough people contribute as it is.  Fewer
 still that know the code base very well.  Submit patches.

I don't have that much free time on my hands.  If I did I'd long ago
have released a forked version of CVS that did not have any of the
features I consider dangerous or counterproductive.  In fact if I had
that much available time I'd probably even have rewritten it from
scratch by now!

   Discuss the issues.

I am taking the time to discuss the issues!  I very nearly unsubscribed
from this list simply because of the spam problems and the blatant
unwillingness of gnu.org to do anything proactive about them.  I'm
sticking it out (this is the last gnu.org list I subscribe to) because I
still have a bit of a stake in using CVS and I don't want to see the
community continue to misunderstand the security issues inherent in
using CVS.

   Please don't try to limit CVS to a single security model, however.
 SSH  RSH are all well and good, but they are not available for every
 platform and some sysadmins are understandably reluctant to grant
 shell access to every CVS user.

I am most definitely not limiting CVS to any security model!  I am
arguing vehemently for total elimination of any *and* all security
models from *within* CVS.  CVS has no business even suggesting an
appropriate security model for anyone -- in a client/server
implementation it need only make use of *any* external tool capable of
connecting it to an instance of itself acting as a server on some other
machine.

Furthermore CVS has no need to include any built-in security model or
even any built-in communications support, not on any modern platform!

You're free to use any external remote job execution tool that meets
your own security requirements.  If it's as simple as 'nc' and 'nc -I'
then that's your business.  If you want to use rsh in the clear then
that's your business to.  If you choose to use SSH, or stunnel, or any
of the above in combination with a VPN then that's fine too.  You should
feel free to run your CVS server on a single-user operating system if
you want.  Issues of security should remain totally orthogonal to CVS
(and indeed should be deemed inappropriate for this very forum!).

-- 
Greg A. Woods

+1 416 218-0098  VE3TCP  [EMAIL PROTECTED] [EMAIL PROTECTED]
Planix, Inc. [EMAIL PROTECTED];   Secrets of the Weird [EMAIL PROTECTED]

___
Info-cvs mailing list
[EMAIL PROTECTED]
http://mail.gnu.org/mailman/listinfo/info-cvs