Subject: Re: CVS and security.
To: Richard Rauch <rkr@rkr.kcnet.com>
From: Laine Stump <lainestump@rcn.com>
List: netbsd-help
Date: 02/05/2000 19:03:41
At 05:23 PM 2/5/00 -0600, Richard Rauch wrote:
>> > I thought that ssh/sshd might let me do it, but it doesn't seem to
>> > directly support this kind of thing.  Am I missing something?  Or
should I
>> > use something like openssl or ssh-ip-tunnel?  (Or maybe openssh?)
>> 
>> ssh can do it; search the CVS documentation for CVS_RSH.  The summary
>> is that you don't set up a daemon to provide CVS access; your users
>> access the system via ssh and start a CVS process.
>
>You mean substitute ssh for rsh?  Or have users login with ssh and do
>local checkins?

The former. Just setup sshd on the same machine as CVS server, then have
each client do the following on their machine

1) Along with setting the CVSROOT variable, also set CVS_RSH=ssh

2) Configure the ssh client so that it can login to their account on the
server machine without requiring an interactive login (I've never done that
for ssh, so I can't tell you how to do it.

(An alternative to (2) if you're just providing anonymous read-only access
to CVS would be to setup an account on the server that didn't require a
password for ssh access. But then you get into the whole can of worms with
protecting the rest of the system from that account.)