Subject: Problems logging into CVS server

From: Devrim GUNDUZ <[email-masked]>
Date: Mon, 12 Jul 2004 23:45:49 +0300 (EEST)

Hi,

We currently experience problems while logging into CVS server:

[pgsql75@gunduz pgsql75]$ cvs -z3 -d :pserver:[email-masked]:/projects/cvsroot co -P pgsql
cvs checkout: authorization failed: server anoncvs.postgresql.org rejected 
access to /projects/cvsroot for user anoncvs

FYI...
- -- 
Devrim GUNDUZ	       
devrim~gunduz.org				devrim.gunduz~linux.org.tr 
			http://www.tdmsoft.com
			http://www.gunduz.org

---

From: "Marc G. Fournier" <[email-masked]>
Date: Mon, 12 Jul 2004 18:31:38 -0300 (ADT)

Damn ... I'll have to look at it ... we had a hacker get in through the 
way anoncvs was setup, so I set a passwd on in /etc/passwd (but didn't 
touch the anoncvs setup itself) ... will play with it tonight and see if I 
can figure out how to do a more secure anon-cvs ;(  I have to be missing 
something in the config *sigh*

On Mon, 12 Jul 2004, Devrim GUNDUZ wrote:

> ------------------------------------------------------------------------------
> /usr/local/libexec/ppf_verify: pgp command failed
>
> gpg: WARNING: using insecure memory!
> gpg: please see http://www.gnupg.org/faq.html for more information
> gpg: Signature made Mon Jul 12 17:45:51 2004 ADT using DSA key ID 748F7D0E
> gpg: Can't check signature: public key not found
> ------------------------------------------------------------------------------
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> Hi,
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (GNU/Linux)
>
> iD8DBQFA8vh/tl86P3SPfQ4RAqy8AJ0RT1BoFpJjiWZgfbSxpookbTaZTACfeIGo
> UCNQv5zjByUhdjMt7w6TCYI=
> =m2Ks
> -----END PGP SIGNATURE-----
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 3: if posting/reading through Usenet, please send an appropriate
>      subscribe-nomail command to [email-masked] so that your
>      message can get through to the mailing list cleanly
>

----
Marc G. Fournier           Hub.Org Networking Services (http://www.hub.org)
Email: [email-masked]           Yahoo!: yscrappy              ICQ: 7615664

---

From: Justin Clift <[email-masked]>
Date: Tue, 13 Jul 2004 10:53:00 +1000

Marc G. Fournier wrote:

> touch the anoncvs setup itself) ... will play with it tonight and see if 
> I can figure out how to do a more secure anon-cvs ;(  I have to be 
> missing something in the config *sigh*

Um, that sounds worrying.  Was the activity of the hacker anything that 
would affect PG code, or access to anything sensitive (account 
passwords, etc)?

Regards and best wishes,

Justin Clift

---

From: "Marc G. Fournier" <[email-masked]>
Date: Mon, 12 Jul 2004 22:16:45 -0300 (ADT)

On Tue, 13 Jul 2004, Justin Clift wrote:

> Um, that sounds worrying.  Was the activity of the hacker anything that would 
> affect PG code, or access to anything sensitive (account passwords, etc)?

No ... anoncvs is not part of the same group as the primary cvsroot, so 
not able to commit to the source tree ... the anoncvs cvsroot is a 
different directory structure altogether (/projects/cvsroot vs /cvsroot), 
and the anoncvs user has no write permissions on /cvsroot ...

----