<div dir="ltr">Hi All,<br><br><div class="gmail_quote">On Thu, Jul 31, 2008 at 10:50 AM, Sam Boyer <span dir="ltr"><<a href="mailto:drupal@samboyer.org">drupal@samboyer.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">On Thu, 2008-07-31 at 10:46 -0700, Derek Wright wrote:<br>
> On Jul 31, 2008, at 9:40 AM, Angela Byron wrote:<br>
><br>
> > 1. Security. pserver authentication is horribly, horribly insecure.<br>
><br>
> I think the security problems will be just as bad with SVN given the<br>
> OSUOSL infrastructure. There's a way to do CVS securely (over ssh),<br>
> which is basically equivalent to what we'd have to do to actually<br>
> make SVN secure (as far as I know), but the OSUOSL side of this<br>
> question has been "won't fixed" because it would involve giving<br>
> (extremely limited) shell access to every CVS account holder:<br>
><br>
> <a href="http://drupal.org/node/199412" target="_blank">http://drupal.org/node/199412</a><br>
><br>
> I'll admit I haven't closely studied SVN's various security models,<br>
> so I could be wrong about this, but on the surface, I think this<br>
> particular argument is a red herring, since we couldn't configure SVN<br>
> any more securely than we can configure CVS. If anyone can provide a<br>
> link to a clear document explaining how to configure SVN more<br>
> securely than pserver if you don't actually have accounts and ssh<br>
> keys for everyone, please do so.<br>
<br>
</div>So let me quickly just respond here to say that, in fact, SVN is almost<br>
terrifyingly easy to set up securely using SSH. No need for shell<br>
accounts per user. Obviously using ssh keys means that we'd need to<br>
_get_ those public keys from people in the first place, and doing so<br>
would also be a very real change for all contributors: either you learn<br>
SSH, or you can't contribute to drupal.<br>
<div><div></div><div class="Wj3C7c"></div></div></blockquote><div><br>Actually, an even easier method is to setup SVN access over https - <a href="http://gentoo-wiki.com/HOWTO_Apache2_with_subversion_SVN_and_DAV">http://gentoo-wiki.com/HOWTO_Apache2_with_subversion_SVN_and_DAV</a><br>
This needs no shell accounts or even SSH keys and can authenticate any way apache can.<br><br>Thanks!<br>- Owen</div></div><br></div>