CVS and Subversion
Subversion
Tips
To convert a CVS repository:
- I'm using ssh and developers are members of the src group, CVS repository is in /home/cvs
- I create /home/svn with the following flags and ownerships, same as for /home/cvs
drwxr-sr-x cvs:src /home/svn
- To convert /home/cvs/linux-doc repository:
su -s /bin/bash cvs -c "cvs2svn -s /home/svn/linux-doc /home/cvs/linux-doc"
- All files and dirs for which user has write access, give it also to group
find /home/svn/linux-doc -perm -200 -exec chmod g+w {} \;
To checkout the project:
svn checkout svn+ssh://devel.yobi.be/home/svn/linux-doc/trunk linux-doc
Doc
svk
Doc
CVS
Installing a CVS server
A more secure setup for a chroot-ed CVS server is explained here: http://olivier.sessink.nl/jailkit/howtos_cvs_only.html
apt-get install cvs
mkdir -p /home/server/chroot-cvs
cd /home/server/chroot-cvs
mkdir -p bin dev etc home lib libexec sbin tmp var
mkdir -p var/run var/chroot/sshd
ln -s . usr
chmod 555 home
chmod 1777 tmp
cp /bin/bash /bin/false /usr/bin/cvs /usr/bin/passwd bin
cp -d /bin/sh bin
cp /usr/sbin/sshd sbin
cp /etc/passwd /etc/shadow /etc/group etc
cp -rf /etc/ssh etc
cd /home/server/chroot-cvs/dev
/dev/MAKEDEV std pty random
cd /home/server/chroot-cvs
cp `ldd bin/* sbin/* | awk '{print $3}'` lib
cp -d /lib/ld* lib
cp -d /lib/libnss_compat* lib
cp -dr /lib/security lib
cp -r /etc/pam.d etc
cat << EOF > /home/server/chroot-cvs/etc/group
wheel:x:0:root
nogroup:x:65534:
cvs:x:500:phil
EOF
cat << EOF > /home/server/chroot-cvs/etc/passwd
root:x:0:0:root:/root:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/false
sshd:x:100:65534::/var/run/sshd:/bin/false
phil:x:1000:500:Philippe Teuwen:/home:/bin/sh
EOF
cat << EOF > /home/server/chroot-cvs/etc/shadow
root:*:12534:0:99999:7:::
nobody:*:12488:0:99999:7:::
sshd:!:12488:0:99999:7:::
phil:*:12534:0:99999:7:::
EOF
mkdir -p cvsroot
chown 1000:500 cvsroot
chmod 775 cvsroot
chmod g+s cvsroot
cvs -d/home/server/chroot-cvs/cvsroot init
# Initialisation of passwords:
chroot /home/server/chroot-cvs
passwd
passwd phil
exit
cd /home/server/chroot-cvs/etc/ssh
/usr/bin/ssh-keygen -t rsa1 -b 1024 -f ssh_host_key -N
/usr/bin/ssh-keygen -t dsa -f ssh_host_dsa_key -N
/usr/bin/ssh-keygen -t rsa -f ssh_host_rsa_key -N
# Edit sshd_config -> Port 2233
# Launch ssh server:
chroot /home/server/chroot-cvs /sbin/sshd
cvs-makerepos cvs init
Infos
- Building your company CVS-server
- How to install CVS on your e-smith server
- In chroot jail: http://www.pointless.nl/~peter/stuff/cvs-server.html
find . -type d -exec chmod g+s {} \; (ne pas oublier le backslash avant le ";")
find . -type d -exec chown cvs:cvs {} \;
find . -type d -exec chmod 775 {} \;
find . -type f -exec chown cvs:cvs {} \;
find . -type f -exec chmod 664 {} \;
With pserver
To add a user or update password:
cd CVSROOT htpasswd passwd <user>
edit the file and append ":cvs" to the line (it's removed even when updating the passwd)
For anonymous access (with "anonymous" as password):
add the following line to CVSROOT/passwd file:
anonymous:23MLN3ne5kvBM:cvs
and add the following to the (maybe not yet present) CVSROOT/readers:
anonymous
edit CVSROOT/config and uncomment:
SystemAuth=no
to avoid regular accounts to be usable to log in so only the ones in CVSROOT/passwd will work
To access the cvs server:
export CVSROOT=:pserver:<user>@<host>:<path>
For anonymous read-only access:
export CVSROOT=:pserver:anonymous@<host>:<path>
then
cvs login
To allow only CVS with ssh
disable user's passwd (in /etc/shadow: user:!:...)
add to ~user/.ssh/authorized_keys:
command="/usr/bin/cvs server" ssh-rsa <PUBKEY...>
To create a CVS rep on the vserver
On the vserver: be sure the /home/cvs is drwxr-sr-x cvs:src
su -s /bin/bash cvs -c "cvs -d ~/<newrep> init"
On the client: go into the rep to be imported
cvs -d :ext:devel.yobi.be:/home/cvs/<newrep> import -m "First draft" <module_name> <author/vendor> <version>
Delete imported rep
cvs -d :ext:devel.yobi.be:/home/cvs/linux-doc co lpic
Old notes
Converted with HTML::WikiConverter::MediaWiki from my old phpwiki site
Edition des fichiers de CVSROOT:
En général on peut procéder ainsi:
- cvs co CVSROOT
- create CVSROOT/<myfile>
- echo <myfile> >> CVSROOT/checkoutlist
- cd CVSROOT; cvs commit
Mais pour des raisons de sécurité il vaut mieux ne pas le faire pour les fichiers passwd et readers...
Interdiction de récupérer le module CVSROOT:
La FAQ de CVS suggère d'ajouter "CVSROOT -a" dans CVSROOT/modules
Cependant ce n'est pas complètement sécurisé car il reste un moyen d'obtenir et de modifier ces fichiers ;-)
cd /tmp mkdir CVS echo "D" > CVS/Entries echo "$CVSROOT" > CVS/Root echo "CVSROOT" > CVS/Repository cvs update
Et voilà :-)
Si vous ne voulez pas qu'on accède au module CVSROOT alors vous n'en n'avez peut-être tout simplement pas l'usage.
Effacez-le sur le serveur CVS!
rm CVSROOT/*,v