* gmu 2k6 <gmu2006@gmail.com> [2006-07-15 12:06:57]:
> is there no way to use crypt(), md5(), hashXY(), bcrypt() for password
> enrires in the passwd file when using svnserve? using mod_dav_svn or
> tunneling svn via SSH is no option right now.
> if there really is no way I might fall back to writing a passwd
> management tool which works with base64 passwords but of course writes
> them debase64'ed into passwd. this way at I would have to actievely
> take a peek at passwd to see the passwords.
This issue is tackled in the FAQ: the authentication method (cram-md5)
permits having secure, tamper-proof authentication over an insecure
channel, at the expense of requiring storage of plaintext passwords on
the server side.
It has been our long time policy to not offer any obfuscation method,
as security through obscurity is just an artificial way of falsely
raising your trust in part of the system, just as it was in CVS' day.
However, you will note that the more complete solution to this problem
- supporting svn:// over SSL and implementing full support for a SASL
library - is being worked on right now.
With this solution, you will have many authentication methods
available, most of which do not store passwords as plaintext on the
server (but that do require the secure communications layer provided
by SSL, as the authentication protocols themselves are susceptible to
attack).
- Dave
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Received on Sat Jul 15 15:21:18 2006