On 7/15/06, David Anderson <david.anderson@calixo.net> wrote:
> * gmu 2k6 <gmu2006@gmail.com> [2006-07-15 12:06:57]:
> > is there no way to use crypt(), md5(), hashXY(), bcrypt() for password
> > enrires in the passwd file when using svnserve? using mod_dav_svn or
> > tunneling svn via SSH is no option right now.
> > if there really is no way I might fall back to writing a passwd
> > management tool which works with base64 passwords but of course writes
> > them debase64'ed into passwd. this way at I would have to actievely
> > take a peek at passwd to see the passwords.
>
> This issue is tackled in the FAQ: the authentication method (cram-md5)
> permits having secure, tamper-proof authentication over an insecure
> channel, at the expense of requiring storage of plaintext passwords on
> the server side.
>
> It has been our long time policy to not offer any obfuscation method,
> as security through obscurity is just an artificial way of falsely
> raising your trust in part of the system, just as it was in CVS' day.
as long as I have to administer a passwd file with plaintext entries I
will need a tool anyway, which allows the users to change their
passwords and me to not touch the file with an editor. this way I
won't need to see the passwords as base64 can be used as a method to
obfuscate it for the common human brain so far that one won't be able
to decode it instantly (individuals being able to tell you the sqrt of
123876876123 put aside of course :D).
> However, you will note that the more complete solution to this problem
> - supporting svn:// over SSL and implementing full support for a SASL
> library - is being worked on right now.
Nice. Plus the SASL work will make svnserve that much more useful:
http://svn.haxx.se/dev/archive-2006-07/0300.shtml
> With this solution, you will have many authentication methods
> available, most of which do not store passwords as plaintext on the
> server (but that do require the secure communications layer provided
> by SSL, as the authentication protocols themselves are susceptible to
> attack).
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Received on Sat Jul 15 15:28:25 2006