bugtraq - Re: Webserver CVS (In)Security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 1 Apr 2003 22:09:05 -0800
From: "Crist J. Clark" <crist.clark@...bi.com>
To: bugtraq@...urityfocus.com, vuln-dev@...urityfocus.com
Subject: Re: Webserver CVS (In)Security


On Sun, Mar 30, 2003 at 04:42:02PM -0500, methodic@...pcap.net wrote:
[snip]

> In the end I chose to delete all CVS directories and files in my webroot
> with this command: find /www -name CVS -type d | xargs rm -rf which I
> have in a shell script that pushes the CVS site live. I didn't need them
> around and I didn't feel like messing around with httpd.conf. I'm not
> sure why people would want to keep them around.. maybe there's a tool
> that performs some sort of statistics. If that's the case, you should
> write a regex in your webserver's config file (if it has that option) to
> deny CVS and anything below it.

No, what you should be doing is a,

  $ cvs export web-root

And NOT a 'checkout.'
-- 
Crist J. Clark                     |     cjclark@...m.mit.edu
                                   |     cjclark@....edu
http://people.freebsd.org/~cjc/    |     cjc@...ebsd.org