Re: CVS'r'us

[Lars Magne Ingebrigtsen <larsi@ifi.uio.no>]

Kai Grossjohann <grossjohann@ls6.informatik.uni-dortmund.de> writes:

> My CVS manual (version 1.9) contains a section "Remote repositories".
> It mentions password authentication, too.

I've now fetched the full cvs distribution, and have the info file.
It says:

----------
The separate CVS password file (*note Password authentication
server::.) allows people to use a different password for repository
access than for login access.  On the other hand, once a user has
access to the repository, she can execute programs on the server system
through a variety of means.  Thus, repository access implies fairly
broad system access as well.  It might be possible to modify CVS to
prevent that, but no one has done so as of this writing.  Furthermore,
there may be other ways in which having access to CVS allows people to
gain more general access to the system; noone has done a careful audit.
----------

This sounds like something that one doesn't want to have on a systems
that's supposed to be secure, doesn't it?

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@ifi.uio.no * Lars Ingebrigtsen