8.6 The kserver Access Method

The kserver method is used to connect using Kerberos 4. If you do not have an existing Kerberos 4 installation on your CVS repository server, I recommend you use Kerberos 5. Kerberos 4 has known weaknesses that Kerberos 5 resolves. This section assumes that you have an existing Kerberos 4 installation and the documentation to configure and use it.

Kerberos 4 is a reasonably secure authentication system, but it has known flaws. Kerberos 5 fixes some of them; most critically, it prevents a replay attack. In Kerberos 4, there is a five-minute window in which an attacker can sniff an authentication request, modify and re-send it, and get an authentication ticket. Kerberos 5 allows only one ticket to be produced per request.

The repository path format for Kerberos is:

:kserver:[user@]hostname[:[port]]/path

The default port for kserver is 1999. If user is not specified, the client sends the username of the calling user on the client computer.

The CVS client and server must both be compiled to run Kerberos 4. If you intend to encrypt the data stream, you also need to have encryption enabled at compile time. You can test whether your CVS program has compiled kserver support by checking the command list, as shown in Example 8-11.

Example 8-11. Testing for kserver mode

bash-2.05a$ cvs --help-commands
CVS commands are:
.
.
.
        kserver      Kerberos server mode
.
.
.
(Specify the --help option for a list of other help options)

You can test for encryption support by checking the options list, as shown earlier in Example 8-9.

To use CVS with kserver, install and configure Kerberos 4 as described in your Kerberos manual. You need to have the header files for Kerberos 4 available for CVS to link to. The principal name for CVS is cvs.

To recompile CVS to support Kerberos 4, follow the instructions in Chapter 2 on installing from source. Use the --with-krb4[=header-files] option to configure to get Kerberos authentication support. Use the Kerberos directory as the argument to --with-krb4. (You need the Kerberos directory you intend to compile against, usually one with include and lib subdirectories.) If you also desire encryption, use --enable-encrypt as well.

Check your INSTALL file for the exact syntax of configure options in your version of CVS.

CVS needs to run a server on the repository computer to support the kserver access method. Edit inetd.conf and add a line for cvs kserver. See Section 8.8 of this chapter for details on how to edit inetd.conf.

Using Kerberos 4, CVS can encrypt the data stream, but it does not do this by default. Use the -x option to encrypt the data stream. You may want to include this option in your .cvsrc file. For example:

cvs -x

To run CVS, get a Kerberos ticket for the user on your client; then call CVS the usual way with the kserver method. Example 8-12 shows how to check out a sandbox using the kserver access method.

Example 8-12. Using the kserver access method

bash$ cvs -d :kserver:helit:/var/lib/cvs checkout wizzard
cvs server: Updating wizzard
U wizzard/Changelog
U wizzard/INSTALL
U wizzard/Makefile