Security options :-(

[Phil R Lawrence]

Satya Prasad DV wrote:
> At 02:32 PM12/17/2002, Mike Ayers wrote:
>> Here's a bit of a challenge for the list.  We need to set up
>> a CVS repository on a Linux server such that the users can't
>> modify the files, except through proper CVS operations.  The
>> catch?  They are currently permitted to log into the server.
> The cvs user id and group id need to be different from all
> other login users. And set permissions for repository such
> that the cvs user and group only are given write
> permissions. This should suffice

And then what?  Use pserver to map the existing user ids to the cvs id?

I have been trying to figure out a secure way to set this thing up, but 
each way seems to have big drawbacks.

Method 1
  description:
  - users SSH into existing accounts.
  - repository has group permissions that allow users to
    check in and out, etc.

  drawback:
  - users can modify the history files, because they are
    located in the same dir as source files.  Audit function
    is thus compromised.

Method 2
   description:
   - pserver via SSH

   drawback:
   - "any CVSpserver user can trivially spoof any other
     at several levels." --Greg A. Woods
     Thus audit function is again compromised.

Can anyone elaborate or correct this?
Phil