Re: Webserver CVS (In)Security

From: Crist J. Clark (crist.clarkat_private)
Date: Tue Apr 01 2003 - 22:09:05 PST

  • Next message: Blue Boar: "Re: Generating Hex Numbers to brute force rs_iis.c" 

    On Sun, Mar 30, 2003 at 04:42:02PM -0500, methodicat_private wrote:
[snip]

> In the end I chose to delete all CVS directories and files in my webroot
> with this command: find /www -name CVS -type d | xargs rm -rf which I
> have in a shell script that pushes the CVS site live. I didn't need them
> around and I didn't feel like messing around with httpd.conf. I'm not
> sure why people would want to keep them around.. maybe there's a tool
> that performs some sort of statistics. If that's the case, you should
> write a regex in your webserver's config file (if it has that option) to
> deny CVS and anything below it.

No, what you should be doing is a,

  $ cvs export web-root

And NOT a 'checkout.'
-- 
Crist J. Clark                     |     cjclarkat_private
                                   |     cjclarkat_private
http://people.freebsd.org/~cjc/    |     cjcat_private

    This archive was generated by hypermail 2b30 : Thu Apr 03 2003 - 09:48:45 PST