Secure-CVS-Pserver(1).pdf

Secure CVS Pserver Mini−HOWTO

Morgon Kanter

< morgon AT surgo DOT net >

February 2003

Revision History

Revision 1.1

2003−03−21

Revised by: mk

Fixed a missing link and added a section on CVSGrab

Revision 1.0

2003−02−01

Revised by: mk

Initial Release, reviewed by LDP.

This document will help you set up a more secure CVS Pserver for anonymous CVS access.

Permission is granted to copy, distribute, and/or modify this document under the terms of the GNU Free

Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no

Invariant Sections, no Front−Cover Texts, and no Back−Cover Texts. A copy of the license is included in

Section 6 , entitled "GNU Free Documentation License".

Secure CVS Pserver Mini−HOWTO

Table of Contents

1. Introduction. ....................................................................................................................................................1

2. Getting the tools. .............................................................................................................................................2

2.1. What you need. .................................................................................................................................2

2.2. Compiling the tools. ..........................................................................................................................2

2.2.1. Compiling CVS. ......................................................................................................................2

2.2.2. Compiling cvsd.. ......................................................................................................................2

3. Setting up the tools. .........................................................................................................................................3

3.1. Creating the CVS Repository. ..........................................................................................................3

3.2. Setting up the jail. .............................................................................................................................3

3.2.1. Transferring the necessary files. ..............................................................................................3

3.2.2. Configuring cvsd. ....................................................................................................................4

3.3. Adding anonymous access. ...............................................................................................................4

3.4. Not quite done yet! Changing lock file locations. ............................................................................5

4. Alternatives to the Pserver. ............................................................................................................................6

4.1. Access for developers. ......................................................................................................................6

4.2. Anonymous CVS access by http. ......................................................................................................6

4.3. CVSGrab. ..........................................................................................................................................6

Notes. .................................................................................................................................................7

5. Acknowledgements .........................................................................................................................................8

6. GNU Free Documentation License. .............................................................................................................14

1. Introduction

CVS Pserver is, by definition, an insecure protocol. Among other things, passwords are transmitted in plain

text, making it undesirable for much use. However, CVS Pserver is very good for providing anonymous CVS

access to a repository.

In this document we will introduce you to setting up a CVS repository (although not intruding on the CVS

HOWTO's space), and how to set up a chroot jail for the Pserver. We will also talk about using SSH for

developer access to a repository.

1. Introduction

2. Getting the tools

2.1. What you need

You'll need the following things in order to set up a secure Pserver:

CVS

Of course, you will need to have CVS in order to be running it. You can get it here .

cvsd

cvsd is a program that will run the CVS Pserver in a chroot jail. You can get i t here .

SSHd

If you want your developers to have secure access to the repository, you'll have to be running an SSH

server. However, setting up that access is beyond the scope of this Mini−HOWTO. More information

can be found at the CVS−RCS howto .

2.2. Compiling the tools

If you are compiling from the sources, follow these instructions. If you downloaded binaries, skip ahead to

Section 2.2.2 .

2.2.1. Compiling CVS

After you have downloaded the CVS sources, unpack them into a directory and cd into it. The default prefix is

/usr/local ; we've changed it to /usr for this example. You might want to change mandir to wherever

your man pages reside (the default is PREFIX/man ).

$ ./configure −−prefix=/usr

$ make

# make install

2.2.2. Compiling cvsd

There are a few configure switches you should be aware of here. The default prefix is /usr/local , which

in this document we are changing to /usr . You should also change sysconfdir to /etc , where the

system config files usually reside. You might want to change mandir to wherever your manual pages reside

as well.

$ ./configure −−prefix=/usr −−sysconfdir=/etc

$ make

# make install

Now lets go on to setting up these wonderful tools.

2. Getting the tools

3. Setting up the tools

Now that CVS and cvsd are built, let's set them up.

3.1. Creating the CVS Repository

Before we begin, I strongly recommend you read the CVS manual that was installed with the rest of CVS. If

the stand−alone info browser or the texinfo package is installed on your system, you can see this manual by

typing the command info cvs at your shell.

First, plan out where you want your repository. Debian defaults to /var/lib/cvs . My repository is under

the directory /cvs/root , and is on its own small partition. What you do depends on your needs and can

vary widely.

Make sure that the repository is a subdirectory of an empty directory! For example, if you are installing

it into /var/lib/cvs , put the repository in /var/lib/cvs/root (or whatever you want for the

last directory). This is because we create a chroot jail for the Pserver!

After you have planned where you want to put your repository, made the necessary partitions, if desired, and

run the following command (we assume that it will be at /cvs/root ):

$ cvs −d /cvs/root init

That will initialize your repository and set up the necessary CVSROOT files.

3.2. Setting up the jail

Now that we have the CVSROOT set up, we need to copy the appropriate libraries and files for cvsd, which

runs the Pserver in the chroot jail.

3.2.1. Transferring the necessary files

If you installed cvsd from a package management system like RPM, this may already be done for you. If

that is the case, skip ahead to the next step.

Change your directory to /cvs (or whatever the directory before your root is) and enter the following

commands:

$ cvsd−buildroot /cvs

$ mkdir −p var/lock

$ adduser cvsd

$ addgroup cvsd

Thankfully, cvsd comes with the script cvsd−buildroot , so we don't have to do all the necessary copying by

3. Setting up the tools

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: