58251 - make cvs-over-SSH access easy to use and encourage conversion

Status: RESOLVED FIXED

(mozilla.org Graveyard :: Server Operations, task, P3)

Description

[Dan Mosedale (:dmosedale, :dmose)]

The sourceforge folks have some already setup packages, at least from windows,
for using CVS-over-SSH.  We should test those out and perhaps link to them.
This depends on despot supporting user-management of this sort.

Comment 1

[Dan Mosedale (:dmosedale, :dmose)]

There now appears to be a Mac client that supports portforwarding at
<http://www.macssh.com>.  Thanks to Ben Bucksch for the pointer.  We need to
test this with MacCVS.

Comment 2

[Ben Bucksch (:BenB)]

More SSH clients at <http://www.openssh.com/windows.html>.

Sourceforge CVS/SSH/Unix docs:
<http://sourceforge.net/docman/display_doc.php?docid=763&group_id=1>,
<http://sourceforge.net/docman/display_doc.php?docid=765&group_id=1>

Comment 3

[Dan Mosedale (:dmosedale, :dmose)]

Mass reassign of mozilla.org infrastructure bugs, as I'm switching groups to
work on LDAP integration in Mozilla full-time.

Comment 4

[timeless]

teratermpro w/ ttssh supports port forwarding for windows.

Comment 5

[David Krause]

This would be very nice to have and is fairly easy to setup.  The main
disadvantage is that every user with cvs access needs to have an account on the
cvs server.  You don't need to run pserver or any other daemons except for ssh.
At least this is how the openbsd guys do it.  Then you just export
CVSROOT=user@cvsserver:/cvsroot and CVS_RSH=/usr/bin/ssh and it works like
normal except it is using ssh to encrypt it.  It is also possible to have
anoncvs over ssh also using a chrooted shell that the OpenBSD guys wrote for
that purpose.

I've got this working on my box btw, with the oopsbot/mozbot source code
available over ssh.

Comment 6

[Gervase Markham [:gerv]]

Dawn: could the work for this be done at the same time that we upgrade the CVS
server?

Gerv

Comment 7

[Ben Bucksch (:BenB)]

timeless wrote:
wincvs + ssh:
  <http://minimal.cx/wincvsssh.php>
mac(classic)cvs + ssh:
  <http://sourceforge.net/docman/display_doc.php?docid=2973&group_id=1>
  ^ url subject to change.


IMO, we should just mandate CVS over SSH, getting rid of write access using
pserver. Just a few revealed passwords are enough...

Comment 8

[Ralf Hauser]

FYI, you can even do that without giving the users a full shell on the server!
http://bugzilla.mindrot.org/show_bug.cgi?id=479
Perhaps you want to add a description of this to
http://www.mozilla.org/README-cvs.html?
(David is the zzh.c there the OpenBSD shell you are referring to or do you have
any other links for that?)

I support David's idea to also offer anoncvs over ssh: How about making this
possible and documenting it in http://www.mozilla.org/cvs.html?

P.S.: Astonishingly, one neighbouring community wasn't particularly receptive to
the idea of them promoting to progress from "privacy as an exception" to a
"privacy by default" priniciple even though it is already working there
(http://nagoya.apache.org/bugzilla/show_bug.cgi?id=16601).
Others appear to be one step ahead http://www.openbsd.org/anoncvs.html.

Comment 9

[David Krause]

The source and instructions for anoncvs over ssh:
http://www.openbsd.org/anoncvs.shar

Also the paper:
http://www.openbsd.org/papers/anoncvs-paper.ps

Comment 10

[Ralf Hauser]

a password-less approach to also consider is described in
http://kitenet.net/programs/sshcvs/ (probably needs a second login (e.g.
anoncvs_nopass) - suggestion: provide this option too and document it in
http://www.mozilla.org/cvs.html). 

Comment 11

[Dave Miller [:justdave]]

Since all the comments here seem to be about implementation of the server, I
just thought I would point out (to head off any additional comments on the
subject) that our server is already set up to be able to handle this (and
there's a select few people set up for it already), but we can't encourage
widespread use of it until we have an easy way to handle user management (like
letting you upload your own ssh key to despot and having infrastructure on the
cvs server to allow despot to create, rename, and destroy ssh accounts).  Right
now a shell account with anoncvssh has to be set up manually by a sysadmin, and
we're not going to do that for thousands of users. :)

So this bug is basically auto-fixed when bug 58246 is resolved.  If someone
wants to hack on despot for us, please do. :)

Removing helpwanted keyword here, since bug 58246 has it, and that's where the
help is actually needed.

Comment 12

[Dave Miller [:justdave]]

*** Bug 175133 has been marked as a duplicate of this bug. ***

Comment 13

[Dave Miller [:justdave]]

err..  I guess reassign to default works better if it's in the right component. :)

Comment 14

[Dave Miller [:justdave]]

Despite the lack of despot support for it, this has already been done.  Getting
despot support will cover the "easy to use" part.