Re: SSL pserver, CVS

Brian Murphy <[email protected]> writes:

>     continuing on from my work on PAM I would like to
> implement pserver over ssl to remove a security hole.
> I can see there was a long discussion, going nowhere,
> between a /Greg A. Woods/ (a very angry man it seems)
> and /Derek R. Price/ ;-) in 2001about an stunnel implementation.
> I thought of this too but I really don't like it - the setup is too
> complicated for ordinary people - even I would prefer to sit
> down for a few weeks and implement ssl support than use
> this awkward solution (which I'm sure I could set up in a few
> hours). I can see it working on the server side but on the client
> side configuration is too complicated.
> 
> Please don't mention any ssh related solutions - I really don't want
> people to have local shell access on the cvs server.
> 
> Is anyone interested in seeing this implemented and getting it included
> in CVS, that is, apart from me? Or perhaps it's already done?
> 
> /Brian

I have seen this topic raised previously. 
(See http://asg.web.cmu.edu/sasl/sasl-cvs.html)

Sigh.

I guess I have no strong objections as such to adding SASL to cvs, in
fact it is probably a good idea to avoid sending passwords in the clear
over wireless and LANs especially if folks are going to start using the
PAM passwords feature (one could say that using PAM leads to NEEDING to
use SASL and that it is all part of the same avalanche of creeping
featurism

If it is going to be done, I think it should probably be a command that
is issued on the existing port rather than reserving a separate port for
it. The client would issue a command like the "starttls" command used by
IMAP and POP3 and SMTP clients to request the server begin SASL
negotiations...

I would suggest that it should also be a configure option as not every
one will have or want to use openssl libraries (or some other package)
installed to support SASL.

To be honest, I would rather that everyone just used SSHv2 as the
transport for CVS client/server. The cvs application is just not secure
as it stands and trying to hide this fact behind PAM and SASL will just
confuse people and give them a false sense of security...

For what it may be worth, it is trivial to setup an STUNNEL wrapper for
:pserver: on a separate port. See stunnel.org for more information on
the stunnel program.

	Enjoy!
	-- Mark