compromises (i.e., a system administrator accidentally looking at the file), and will not prevent even a naive attacker from gaining the password.

The separate cvs password file (see Section 2.9.3.1 [Password authentication server], page 21) allows people to use a di erent password for repository access than for login access. On the other hand, once a user has non-read-only access to the repository, she can execute programs on the server system through a variety of means. Thus, repository access implies fairly broad system access as well. It might be possible to modify cvs to prevent that, but no one has done so as of this writing.

Note that because the ‘$CVSROOT/CVSROOT’ directory contains ‘passwd’ and other files which are used to check security, you must control the permissions on this directory as tightly as the permissions on ‘/etc’. The same applies to the ‘$CVSROOT’ directory itself and any directory above it in the tree. Anyone who has write access to such a directory will have the ability to become any user on the system. Note that these permissions are typically tighter than you would use if you are not using pserver.

In summary, anyone who gets the password gets repository access (which may imply some measure of general system access as well). The password is available to anyone who can sni network packets or read a protected (i.e., user read-only) file. If you want real security, get Kerberos.

2.9.4 Direct connection with GSSAPI

GSSAPI is a generic interface to network security systems such as Kerberos 5. If you have a working GSSAPI library, you can have cvs connect via a direct tcp connection, authenticating with GSSAPI.

To do this, cvs needs to be compiled with GSSAPI support; when configuring cvs it tries to detect whether GSSAPI libraries using Kerberos version 5 are present. You can also use the ‘--with-gssapi’ flag to configure.

The connection is authenticated using GSSAPI, but the message stream is not authenticated by default. You must use the -a global option to request stream authentication.

The data transmitted is not encrypted by default. Encryption support must be compiled into both the client and the server; use the ‘--enable-encrypt’ configure option to turn it on. You must then use the -x global option to request encryption.

GSSAPI connections are handled on the server side by the same server which handles the password authentication server; see Section 2.9.3.1 [Password authentication server], page 21. If you are using a GSSAPI mechanism such as Kerberos which provides for strong authentication, you will probably want to disable the ability to authenticate via cleartext passwords. To do so, create an empty ‘CVSROOT/passwd’ password file, and set SystemAuth=no in the config file (see Section C.11 [config], page 149).

The GSSAPI server uses a principal name of cvs/hostname, where hostname is the canonical name of the server host. You will have to set this up as required by your GSSAPI mechanism.

To connect using GSSAPI, use the ‘:gserver:’ method. For example,

cvs -d :gserver:faun.example.org:/usr/local/cvsroot checkout foo