Re: SSL pserver, CVS

[Brian Murphy]

Mark D. Baushke wrote:

> If it is going to be done, I think it should probably be a command that
> is issued on the existing port rather than reserving a separate port for
> it. The client would issue a command like the "starttls" command used by
> IMAP and POP3 and SMTP clients to request the server begin SASL
> negotiations...
>  
Indeed.

> To be honest, I would rather that everyone just used SSHv2 as the
> transport for CVS client/server. The cvs application is just not secure
> as it stands and trying to hide this fact behind PAM and SASL will just
> confuse people and give them a false sense of security...
>  
SSH reduces security because it gives shell access to a restricted 
server - it
allows write enabled cvs users to remove the repository - why take the risk?
Internally in our company I see this as a much greater risk than that of 
users
passwords being sniffed. The next step is to encrypt the connection but the
first step is to remove users from having shell access to the server.

SSL/TLS - not SASL. That is encryption not authentication.
SASL is in principle similar to PAM, but in practice
it seems much more difficult to use. There are very much fewer programs
supporting SASL than PAM. I think I will investigate SASL at the same time
I look into SSL and really find out what it can do for me - perhaps it 
turns out
to be a better solution than PAM.

/Brian