Date: Sun, 25 Jan 1998 20:54:00 +0100 From: Eivind Eklund <eivind@yes.no> To: Nate Williams <nate@mt.sri.com> Cc: Eivind Eklund <eivind@yes.no>, Andreas Klemm <andreas@klemm.gtn.com>, hackers@FreeBSD.ORG Subject: Re: why not CVS server support ? Message-ID: <19980125205400.52069@follo.net> In-Reply-To: <199801251943.MAA28850@mt.sri.com>; from Nate Williams on Sun, Jan 25, 1998 at 12:43:23PM -0700 References: <19980125175618.10691@klemm.gtn.com> <19980125183247.09801@follo.net> <199801251932.MAA28784@mt.sri.com> <19980125203750.05884@follo.net> <199801251943.MAA28850@mt.sri.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Jan 25, 1998 at 12:43:23PM -0700, Nate Williams wrote: > > With the number of other security problems > > it has had (allowing remote execution), I wouldn't consider that > > secure, either - any kernel security hole that can be exploited by a > > user program could still be abused. > > Umm, what kind of remote execution problems are you speaking of? > PSERVER mode allows you to connet to a port and do remote CVS commands. > Are you confusing PSERVER mode with standard RCVS mode which requires > remote shell access? No, definately not. pserver mode allow the user to overwrite the CVS wrappers, which again allow access to executing binaries. This is a security hole (of the same magnitude as allowing the user to execute binaries directly). If you instead give the user a normal account, set his shell to a script containing "cvs server", and only allow ssh access to your machines, you can use permissions to deny access to the wrapper files. (IIRC, permissions can be walked around in pserver mode. I don't remember quite how, though). Of course, even with a 'cvs server' shell you are vulnerable if there are overflows and similar in CVS. But you are at least only vulnerable to the users you actually give access, as snooping the passwords is no longer possible. Besides, a restricted 'cvs server' shell is much easier to set up and administer than 'cvs pserver' mode :-) Eivind.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19980125205400.52069>