use Perl

• Some quick ideas (Score:2, Informative)

  by IlyaM (2933)

  Do you run CVS pserver as root? In this case "hacker" could create CVS login entry which can give him/her root rights.

  For example:

  # access CVS as root with alternative password
root:HACKER'S_CRYPTED_PASSWORD
# alias some CVS login name to root UID
hacker:HACKER'S_CRYPTED_PASSWORD:root


  Have you checked if commitinfo/loginfo/etc files are not modified. They can be used to run arbitrary code.

  You may want to check if you don't have any rootkits on your computer. Try www.chkrootkit.org [chkrootkit.org].

  --
  

  Ilya Martynov (http://martynov.org/ [martynov.org])
  • Re:Some quick ideas (Score:2)

    by Matts (1087)

    Here's the log entry in it's entirety:

    Date:   Saturday May 18, 2002 @ 8:10
    Author: cvs-axkit
     
    Update of /home/cvs/CVSROOT
    In directory ted:/tmp/cvs-serv32715
     
    Modified Files:
            passwd
    Log Message:
    hmm, try that again
     
    Index: passwd
    ===================================================================
    RCS file: /home/cvs/CVSROOT/passwd,v
    retrieving revision 1.1
    retrieving revision 1.2
    diff -b -u -r1.1 -r1.2
    --- passwd      2002/05/18 07:06:38 
• say (Score:1)

  by pault12 (3066)

  find / -mtime 1
  • Re:say (Score:2)

    by Matts (1087)

    Wouldn't you know I did an apt-get update yesterday evening, making that next to useless. However a check of files modified more recently than something I know I modified yesterday evening before going to bed didn't reveal anything scary.
    
    Neither did chkrootkit.
    
    I hate this sort of thing. It feels like such a waste of my day - especially when it's targetted at open source resources like my server. The jollies of the few ruin it for the rest of us.
• apache.org or perl.org (Score:2)

  by ask (83)

  that's why you want to get your stuff hosted by the ASF or at perl.org; others will take care of most such worries and hassles for you! :-)

  --
  

  -- ask bjoern hansen [askbjoernhansen.com], !try; do();
  • Re:apache.org or perl.org (Score:2)

    by Matts (1087)

    Well I host AxKit on apache.org. However that still leaves approx 60 projects in my CVS server... I suppose I could bump every single damn one onto sourceforge, but really, do I want to do that? Some of course are private projects (but then if they were just private projects I wouldn't need anoncvs I guess) which I couldn't host anywhere but here.
• Can you drop pserver? (Score:2)

  by jdavidb (1361)

  I'm way into using CVSROOT=:ext:user@host:/path/to/repos CVS_RSH=ssh. It's easier to set up than pserver, and probably more secure. I'm pretty sure you could set up an account with no login shell and only read-only access to the repository files and make it work. (But I've never tried it, so YMWV.)

  I hope no damage was done. Maybe the guy didn't know what he was doing and just did all that accidentally (hence the log message)? (Or was just trying something out to see if it would work, as opposed to tr

  --
  J. David works really hard, has a passion for writing good software, and knows many of the world's best Perl programmers
  • Re:Can you drop pserver? (Score:2)

    by Matts (1087)

    I'm considering dropping pserver. I allow it only for anonymous access right now, because people like to follow my projects, and I also prefer people to submit patches against current CVS.
    
    But if it's going to be a security risk then I'll just kill that.