dropbear, cvs, and checkpassword

[Andy Goth]

I'm searching for a way to give developers secure access to my CVS
server.  The :pserver: method is laughable for anything but anonymous
login (like many protocols we know, eh?), so I can't use that.  The
other option I'm willing to consider is :ext: which uses rsh or
compatible to log in to the system, execute "cvs server", and
communicate with said server through the connection.

I'm not root, so things will be running on a nonstandard port.  Oh well.
Because of cvs limitations, I'll have to require that developers use as
CVS_RSH a wrapper that adds -p1234 to the ssh command line.  Or whatever
port.

The developers shouldn't need shell accounts, just CVS access.

Therefore I will not be doing /etc/passwd (and /etc/shadow)
authentication.  So I can configure openssh to disallow passwords and
instead check keys against ~andy/cvs/users/$USERNAME/authorized_keys .

But people will want password access...

So I thought, I can modify dropbear (which looks far easier to edit than
openssh) to use checkpassword rather than getpwwhatever().  See
http://cr.yp.to/checkpwd.html .  Specifically I'd use cvm-checkpassword
with cvm-pwfile; see http://untroubled.org/cvm/cvm.html .  This is what
I use for bincimap, which I didn't need any admin help to set up.

Having a look at the sources, it seems all I need to do is:

1. Create svr-authcheckpassword.c.
2. Add a #define for it.
3. Add to svr-auth.c some code to call my new function.
4. Defeat checkusername().

For my version I'll just make a #define wrapping the call to
checkusername(), or maybe I'll have it comment out the guts of same.  I
don't know yet.

Of course everyone will log in as me.  For this reason I'll have to do
something to ensure that dropbear will only run "cvs server".  I'll also
need to look at cvs to see if it can be convinced to read or overwrite
files not in the CVS repository.

Comments?

-- 
Andy Goth  +  unununium at openverse.com  +  http://ioioio.net/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 253 bytes
Desc: OpenPGP digital signature
Url : http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/attachments/20050905/87093feb/signature.pgp