Thanks...so what is the general consensus about security? Is svnserve
secure enough to open up port 3690 to the world if we don't care about
the data being encrypted?
-----Original Message-----
From: Karl Fogel [mailto:kfogel@google.com]
Sent: Monday, September 18, 2006 2:06 PM
To: Garrett Rooney
Cc: Don Adams; users@subversion.tigris.org
Subject: Re: Question about svnserve and security
"Garrett Rooney" <rooneg@electricjellyfish.net> writes:
> On 9/18/06, Don Adams <dadams@scisol.com> wrote:
>> Hello all...I was hoping somebody could answer this question. I can't
>> seem to find a definitive answer. How secure is the custon protocol
>> svnserve? I know it uses CRAM-MD5 so the password never goes out on
>> the wire in the clear, and it seems that many, or most people use it
>> with SSH to provide an encrypted tunnel. What we want to do is just
>> open up the port for svnserve and NOT use SSH. We do not care if the
>> data is encrypted or not, we do care if the password goes over the
wire though.
>
> svnserve uses CRAM-MD5 authentication, so the password itself never
> goes over the wire, just an md5 hash of it.
Technically, an md5 hash of the plaintext password plus some random
salt, I believe, so that it's a different hash every time. You probably
both knew this, I just wanted to clarify for onlookers, because the salt
makes a big security difference.
-Karl
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Received on Mon Sep 18 20:42:27 2006