Re: Developing a secure CVS repository

[Geoff Beier]

> We have a client/server environment using ssh.  Our Operation Team is
> recommending that we move to a "network-secure CVS server based on 
> SSH and chroot".
> 
> I have seen many questions and discussions on this forum regarding 
> pserver, but I have never seen anything on chroot.
> 
> Does anyone have any experience using this environment and are there 
> any problem associated with it?
> 
> Is there any recommendations?
I have no experience with this environment, but I went to google and pasted
the phrase you have in quotes above then hit "I'm feeling lucky" and was taken
here:

http://www.idealx.org/prj/idx-chrooted-ssh-cvs/dist/chrooted-ssh-cvs-server.html

Is that what your Operation Team is suggesting? The paper details several
problems and the required workarounds/procedures.

I *can* confirm that I wouldn't really like to run my *info scripts in a
chroot()'d environment. I would further add that the source code is the
high-value part of my CVS repository, and I am obligated to allow the proper
users to access that. There would be no payoff to going to the trouble of
restricting their shell accounts and chroot()ing CVS on our repository, as
they will still have permissions to modify the important files on the system.
Filesystem permissions are the best available option for us. YMMV.


> This message may contain confidential information, and is intended 
> only for the use of the individual(s) to whom it is addressed.

In that case, it is a very bad idea to send it to a public mailing list. This
list is archived/published in many places, and would therefore not be a good
place to send anything that may contain confidential information.

HTH,

Geoff