Annotation of www/anoncvs.shar, Revision 1.18
1.1 deraadt 1: # This is a shell archive. Save it in a file, remove anything before
2: # this line, and then unpack it by entering "sh file". Note, it may
3: # create directories; files and directories will be owned by you and
4: # have default permissions.
5: #
6: # This archive contains:
7: #
1.6 deraadt 8: # Makefile
1.1 deraadt 9: # README
10: # anoncvssh.c
11: #
1.6 deraadt 12: echo x - Makefile
13: sed 's/^X//' >Makefile << 'END-of-Makefile'
14: X#CVSROOT=anoncvs@anoncvs1.usa.openbsd.org:/cvs
15: XPROG= anoncvssh
16: XBINOWN= root
17: XBINMODE=4111
18: XBINDIR=/open
19: XNOMAN=
20: X
21: X.include <bsd.prog.mk>
22: X
23: END-of-Makefile
1.1 deraadt 24: echo x - README
25: sed 's/^X//' >README << 'END-of-README'
26: X
1.16 millert 27: X So, you want to run an anoncvs server.
1.7 beck 28: X
29: X A summary of the steps you'll need to do is:
30: X
1.16 millert 31: X1) Find enough disk space to hold the anoncvs tree, and mount it in an
1.14 millert 32: X appropriate place.
1.7 beck 33: X
34: X2) Compile and install anoncvssh, the shell used for the anoncvs user.
35: X ( If you aren't using OpenBSD you'll probably need to compile a sup
1.16 millert 36: X client as well. The easier path is to use OpenBSD ;).
1.7 beck 37: X
38: X3) Add the anoncvs user to the password file, with no password, and
1.14 millert 39: X anoncvssh as it's shell. Decide on a user that will run sup to maintain
1.16 millert 40: X the archive (this is a different user, NOT the anoncvs user).
1.7 beck 41: X
1.14 millert 42: X4) Make a home directory for the anoncvs user. The anoncvs user's
43: X home directory is a chroot jail in which the anoncvssh processes
44: X run when servicing anoncvs requests. The jail must contain the
45: X cvs binary as well as whatever shared libraries and support files
46: X are needed to run them unless you compile and link everything
1.16 millert 47: X statically. This example shows what is needed for OpenBSD. If you
1.14 millert 48: X use another platform you'll need to be familiar with what needs
49: X to go in a chroot jail for your platform.
1.7 beck 50: X
51: X5) Get permission to use sup to obtain the cvs tree from a server.
1.1 deraadt 52: X
1.16 millert 53: X6) Set up sup to retrieve the cvs tree from an appropriate place.
1.7 beck 54: X (If you aren't using OpenBSD you will need to compile and install
55: X a sup client).
1.6 deraadt 56: X
1.16 millert 57: X7) Run sup to retrieve the distribution from the server.
1.3 deraadt 58: X
1.16 millert 59: X8) Once you get the distribution in, set up a cron job to run sup
1.7 beck 60: X periodically to keep your server up to date.
1.6 deraadt 61: X
1.7 beck 62: X**********************************************************************
63: XSTEP 1) find enough disk space.
1.16 millert 64: X You need roughly 2GB.
1.14 millert 65: X Mount it on /open.
66: X If you are not able to mount it as /open, substitute it's location
1.16 millert 67: X throughout the rest of this description.
1.6 deraadt 68: X
1.7 beck 69: X**********************************************************************
1.16 millert 70: XSTEP 2) compile the anoncvssh binary.
71: X In the Makefile, change the variable CVSROOT.
1.14 millert 72: X Install the binary setuid-root in /open/anoncvssh.
1.1 deraadt 73: X
1.7 beck 74: X**********************************************************************
1.16 millert 75: XSTEP 3) Create the anoncvs account and decide who will run "sup"
1.14 millert 76: X to maintain the archive. The anoncvs account should *NOT* be the one
77: X running sup to maintain the archive.
1.1 deraadt 78: X
1.9 beck 79: Xcreate an account similar to:
80: X
1.18 ! millert 81: X anoncvs::32766:32766::0:0:Anonymous CVS User:/open/anoncvs:/open/anoncvssh
1.4 deraadt 82: X
1.16 millert 83: XYes, that is right - the account has no password. Be sure that the
1.14 millert 84: Xuid and gid are unique for your system, if the ones above aren't,
85: Xpick different values.
1.16 millert 86: X
87: XDecide who will run sup to maintain the archive. Call that user
1.14 millert 88: X$SUPUSER. Oh, and in case it hasn't been previously mentioned,
1.16 millert 89: X$SUPUSER should *NOT* be the anoncvs user :).
90: X
91: XSet "PermitEmptyPasswords yes" option in /etc/ssh/sshd_config and
92: Xrestart your sshd daemon.
1.7 beck 93: X
94: X**********************************************************************
1.14 millert 95: XSTEP 4) Build the anoncvs user's home directory chroot jail. This
96: X example assumes that you're using OpenBSD. If you're not you
97: X may need different files in the chroot.
1.4 deraadt 98: X
1.1 deraadt 99: Xmkdir /open/anoncvs
100: Xmkdir /open/anoncvs/cvs
1.6 deraadt 101: Xmkdir /open/anoncvs/sup
102: Xchown -R $SUPUSER /open/anoncvs/cvs /open/anoncvs/sup /open/anoncvs
1.1 deraadt 103: X
1.14 millert 104: XStart filling the account up with nice stuff. You are building a chroot
1.7 beck 105: Xjail for anoncvs in /open/anoncvs.
106: X
1.1 deraadt 107: X cd /open/anoncvs
108: X touch .hushlogin
109: X touch .profile
110: X
1.14 millert 111: XPut a message like the following in .plan:
1.16 millert 112: X To use anonymous CVS install the latest version of CVS on your local
1.6 deraadt 113: X machine.
1.1 deraadt 114: X Then set your CVSROOT environment variable to the following value:
115: X anoncvs@anoncvs.openbsd.org:/cvs
116: X
1.14 millert 117: X chown root:wheel .hushlogin .profile .plan
1.1 deraadt 118: X
119: X mkdir bin dev tmp usr var etc
120: X cp /bin/{cat,pwd,rm,sh} bin/
121: X
1.14 millert 122: XUsing mknod, make a dev/null that has the same major/minor numbers as
1.1 deraadt 123: X your /dev/null, and make it mode 666.
124: X
1.16 millert 125: XSome shared library systems require a dev/zero created in the same way.
1.1 deraadt 126: X
1.14 millert 127: XFill etc space for the account
1.1 deraadt 128: X cp /etc/{group,hosts,passwd,protocols} etc/
129: X cp /etc/{pwd.db,resolv.conf,services,ttys} etc/
130: X modify these files to suit your idea of system security
131: X
1.14 millert 132: Xanoncvssh (by setting the environment variable CVSREADONLYFS) uses
1.16 millert 133: Xa tiny extension provided in the openbsd cvs server code which
134: Xpermits the use of read-only cvs repositories, therefore you MUST
135: Xcompile the openbsd version of cvs. Luckily this is not a problem
136: Xon a non-openbsd machine, since the cvs sources are imported verbatim
137: Xinto the openbsd tree. They are in gnu/usr.bin/cvs. The sources
138: Xare integrated in such way that Makefile.bsd-wrapper knows how to build
1.14 millert 139: Xthe sources on an OpenBSD machine, using obj directories.
1.1 deraadt 140: X
1.14 millert 141: XCreate tmp space for the account
1.16 millert 142: X # (cd var && ln -s ../tmp tmp)
1.13 millert 143: X # chmod a+rwx tmp
1.1 deraadt 144: X
1.13 millert 145: X # mkdir usr/{bin,lib}
146: X # cp /usr/bin/cvs usr/bin/
1.1 deraadt 147: X
1.14 millert 148: XIf your system has ld.so in /usr/libexec,
1.13 millert 149: X # mkdir usr/libexec
150: X # cp /usr/libexec/ld.so usr/libexec/
1.1 deraadt 151: X
1.14 millert 152: XIf using shared libraries, use ldd to find out which shared libs you need:
1.13 millert 153: X # ldd /usr/bin/cvs
1.16 millert 154: X /usr/bin/cvs:
155: X Start End Type Ref Name
156: X 00000000 00000000 exe 1 /usr/bin/cvs
157: X 0015f000 20165000 rlib 1 /usr/lib/libz.so.2.0
158: X 0016d000 20172000 rlib 1 /usr/lib/libgssapi.so.2.0
159: X 0017f000 2018d000 rlib 1 /usr/lib/libkrb5.so.5.2
160: X 00141000 20145000 rlib 1 /usr/lib/libasn1.so.3.1
161: X 00089000 200ba000 rlib 1 /usr/lib/libcrypto.so.10.0
162: X 00177000 2017c000 rlib 1 /usr/lib/libdes.so.8.0
163: X 00169000 2016d000 rlib 1 /usr/lib/libcom_err.so.1.0
164: X 00009000 20053000 rlib 1 /usr/lib/libc.so.30.0
165: X 00002000 00002000 rtld 1 /usr/libexec/ld.so
1.13 millert 166: X
167: X and then copy the required libraries to usr/lib/
1.1 deraadt 168: X
1.14 millert 169: XAs a final pass, make sure that all the files you have just created are
170: Xnot world writable (except dev/null).
1.1 deraadt 171: X
1.7 beck 172: XFor :pserver: support (optional)
173: X - Create an entry in /etc/services
1.16 millert 174: X cvspserver 2401/tcp # CVS client/server operations
1.7 beck 175: X - Create an entry in /etc/inetd.conf
1.16 millert 176: X cvspserver stream tcp nowait anoncvs /open/anoncvssh anoncvssh pserver
1.11 millert 177: X - Create a file /open/anoncvs/cvs/CVSROOT/passwd with the following entry
1.16 millert 178: X anoncvs:AHDysQkJIubEc
1.11 millert 179: X which would be a password of "anoncvs" (as per anoncvs.html)
180: X - Create a file /open/anoncvs/cvs/CVSROOT/readers with a single entry:
1.16 millert 181: X anoncvs
1.11 millert 182: X which tells cvs that user "anoncvs" is allowed readonly access.
183: X - Create a zero-length file /open/anoncvs/cvs/CVSROOT/writers since you don't
184: X want anyone to be able to write to the mirror.
1.16 millert 185: X % cp /dev/null /open/anoncvs/cvs/CVSROOT/writers
1.7 beck 186: X
187: XSee the example layout below for full details.
188: X
189: X**********************************************************************
1.16 millert 190: XSTEP 5): Get sup permission.
1.7 beck 191: Xsend mail to sup@openbsd.org
192: X1) to have sup permissions granted on an appropriate machine for you
1.10 beck 193: X to sup from. We will need to know your host's real hostname and
194: X IP address.
1.16 millert 195: X2) to have an anoncvsN.COUNTRY.openbsd.org alias created.
1.3 deraadt 196: X3) to have your site mentioned in the http://www.openbsd.org page.
197: X
1.7 beck 198: X**********************************************************************
1.16 millert 199: XSTEP 6): Configure sup.
1.7 beck 200: X
201: XIf you're running OpenBSD, you already have a sup client in
202: X/usr/bin/sup. If not you may need to build it. On an IRIX or other
1.14 millert 203: XSYSV machine, ensure that your kernel does not allow a user to chown
1.16 millert 204: Xa file to another user (you may have heard of this particular brand
205: Xof evil referred to as "chown giveaway"). This will cause sup to
1.14 millert 206: Xgive away the files to root before chmod'ing them readable.
207: Xmichaels@openbsd.org knows how to fix this.
1.7 beck 208: X
1.14 millert 209: XThe file /open/anoncvs/sup/ss contains a line that tells sup where
1.16 millert 210: Xto get the cvs tree from. It will normally contain:
1.7 beck 211: X
1.14 millert 212: X cvs host=anoncvs.ca.openbsd.org hostbase=/usr/OpenBSD base=/open/anoncvs delete
1.7 beck 213: X
1.14 millert 214: XThe file /open/anoncvs/sup/cvs/refuse tells sup what files it should not get.
1.11 millert 215: XIt should contain the following lines:
1.7 beck 216: X
217: X cvs/CVSROOT/history
1.11 millert 218: X cvs/CVSROOT/readers
219: X cvs/CVSROOT/writers
220: X cvs/CVSROOT/passwd
1.7 beck 221: X
1.16 millert 222: XIf you ever fetch the file cvs/CVSROOT/history, delete it. It will
1.7 beck 223: Xcause you problems.
224: X
225: X**********************************************************************
1.16 millert 226: XSTEP 7): Run sup to retrieve the tree for the first time.
1.7 beck 227: X
1.16 millert 228: XLog in as or become the $SUPUSER, and run
1.7 beck 229: X
230: Xsup -v /open/anoncvs/sup/ss > /tmp/suplog &; tail -f /tmp/suplog
231: X
232: XIf you have sup permission, and have specified the correct host and
233: Xhostbase in /open/anoncvs/sup/ss you should see a list of files start
234: Xcoming in after a short while. Don't panic if nothing happens
235: Ximmediately. Watch for errors (sup can timeout or die). If you can't
1.16 millert 236: Xaccess files contact the sup server maintainer. If you get a timeout
1.7 beck 237: Xor if sup dies you can restart and it should continue where it left off.
238: X
239: XIt can take a good while (and a couple of restarts) to obtain the
240: Xwhole tree for the first time.
241: X
242: X**********************************************************************
243: XSTEP 8): Set up cron to keep the tree up to date.
244: X
245: XYou run sup periodically from the cron by setting up the crontab file
246: Xof the $SUPUSER.
247: X
248: XFor example: To run every three hours 'sup -v supfile', and thrice
249: Xweekly 'sup -vo supfile' .. because sup is not reliable ..
250: X
251: X0 0,3,6,9,12,15,18,21 * * 0,2,4,5 sup -v /open/anoncvs/sup/ss > /dev/null
252: X0 0,12,15,18,21 * * 1,3,6 sup -v /open/anoncvs/sup/ss > /dev/null
253: X0 3 * * 1,3,6 sup -vo /open/anoncvs/sup/ss > /dev/null
254: X
255: Xanoncvs5.usa.openbsd.org uses this particular set of entries. A `sup
256: X-o' is done every few days because sup is not very robust.
257: X
258: X**********************************************************************
259: XEXAMPLE LAYOUT
260: X
261: XExample layout for OpenBSD. In this example "deraadt" is the $SUPUSER.
1.3 deraadt 262: X
263: X[eap open 5 ]> cd /open
1.16 millert 264: X[eap open 6 ]> ls -alF
1.3 deraadt 265: Xtotal 46
266: Xdrwxr-xr-x 7 root wheel 512 Feb 20 09:58 ./
267: Xdrwxr-xr-x 17 root wheel 512 Jun 14 14:05 ../
268: Xdrwxr-xr-x 9 root wheel 512 Jan 3 21:55 anoncvs/
269: X---s--x--x 1 root bin 16384 Nov 30 1995 anoncvssh*
270: Xlrwxr-xr-x 1 root wheel 11 Jan 3 21:52 cvs@ -> anoncvs/cvs
271: Xdrwxr-xr-x 5 root wheel 512 Feb 22 13:22 ftp/
272: Xdrwxrwxrwt 2 anoncvs wheel 1024 Jan 1 13:18 lost+found/
273: Xdrwxr-xr-x 4 root wheel 512 Nov 30 1995 src/
274: Xdrwxrwxr-x 3 deraadt wheel 512 Dec 4 1995 sup/
275: X[eap open 7 ]> cd anoncvs
276: X[eap anoncvs 8 ]> ls -alF
277: Xtotal 20
278: Xdrwxr-xr-x 9 root wheel 512 Jan 3 21:55 ./
279: Xdrwxr-xr-x 7 root wheel 512 Feb 20 09:58 ../
280: X-r--r--r-- 1 root wheel 0 Nov 30 1995 .hushlogin
281: X-r--r--r-- 1 root wheel 188 Nov 30 1995 .plan
282: X-r--r--r-- 1 root wheel 0 Nov 29 1995 .profile
1.10 beck 283: Xdrwxrwxr-x 2 deraadt wheel 512 Nov 29 1995 bin/
1.3 deraadt 284: Xdrwxrwxr-x 6 deraadt cvs 512 Jun 16 20:28 cvs/
285: Xdrwxr-xr-x 2 root wheel 512 Nov 30 1995 dev/
286: Xdrwxr-xr-x 2 root wheel 512 Nov 29 1995 etc/
287: Xdrwxrwxrwx 3 root wheel 512 Jun 22 07:42 tmp/
288: Xdrwxr-xr-x 5 deraadt wheel 512 Nov 30 1995 usr/
289: Xdrwxr-xr-x 2 root wheel 512 Jan 3 21:55 var/
290: X[eap anoncvs 8 ]> ls -alFR bin usr tmp etc dev
291: Xbin:
292: Xtotal 948
1.10 beck 293: Xdrwxrwxr-x 2 deraadt wheel 512 Nov 29 1995 ./
1.3 deraadt 294: Xdrwxr-xr-x 9 root wheel 512 Jan 3 21:55 ../
295: X--wx--x--x 1 deraadt wheel 40960 Jun 18 09:45 cat*
296: X--wx--x--x 1 deraadt wheel 40960 Jun 18 09:45 pwd*
297: X--wx--x--x 1 deraadt wheel 122880 Jun 18 09:45 rm*
298: X--wx--x--x 1 deraadt wheel 262144 Jun 18 09:45 sh*
299: X
300: Xdev:
301: Xtotal 4
302: Xdrwxr-xr-x 2 root wheel 512 Nov 30 1995 ./
303: Xdrwxr-xr-x 9 root wheel 512 Jan 3 21:55 ../
304: Xcrw-rw-rw- 1 root wheel 2, 2 Nov 30 1995 null
305: X
306: Xetc:
307: Xtotal 112
308: Xdrwxr-xr-x 2 root wheel 512 Nov 29 1995 ./
309: Xdrwxr-xr-x 9 root wheel 512 Jan 3 21:55 ../
310: X-rw-r--r-- 1 root wheel 252 Nov 29 1995 group
311: X-rw-r--r-- 1 root wheel 296 Nov 29 1995 hosts
312: X-rw-r--r-- 1 root wheel 540 Nov 29 1995 passwd
313: X-rw-r--r-- 1 root wheel 1094 Nov 29 1995 protocols
314: X-rw-r--r-- 1 root wheel 40960 Nov 29 1995 pwd.db
315: X-rw-r--r-- 1 root wheel 89 Nov 29 1995 resolv.conf
316: X-rw-r--r-- 1 root wheel 5529 Nov 29 1995 services
317: X-rw-r--r-- 1 root wheel 1361 Nov 29 1995 ttys
318: X
319: Xusr:
320: Xtotal 10
321: Xdrwxr-xr-x 5 deraadt wheel 512 Nov 30 1995 ./
322: Xdrwxr-xr-x 9 root wheel 512 Jan 3 21:55 ../
323: Xdrwxr-xr-x 2 deraadt wheel 512 Nov 30 1995 bin/
324: Xdrwxr-xr-x 2 deraadt wheel 1024 Jun 18 09:50 lib/
325: Xdrwxr-xr-x 2 deraadt wheel 512 Nov 29 1995 libexec/
326: X
327: Xusr/bin:
328: Xtotal 1968
329: Xdrwxr-xr-x 2 deraadt wheel 512 Nov 30 1995 ./
330: Xdrwxr-xr-x 5 deraadt wheel 512 Nov 30 1995 ../
331: X--wx--x--x 1 deraadt wheel 317787 Jun 18 09:46 cvs*
332: X
333: Xusr/lib:
334: Xtotal 5594
335: Xdrwxr-xr-x 2 deraadt wheel 1024 Jun 18 09:50 ./
336: Xdrwxr-xr-x 5 deraadt wheel 512 Nov 30 1995 ../
1.13 millert 337: X-rw-r--r-- 1 deraadt wheel 351730 Jun 18 09:50 libasn1.so.2.0
338: X-rw-r--r-- 1 deraadt wheel 351730 Jun 18 09:50 libc.so.28.5
339: X-rw-r--r-- 1 deraadt wheel 16608 Jun 18 09:50 libcrypto.so.6.0
340: X-rw-r--r-- 1 deraadt wheel 44424 Jun 18 09:50 libdes.so.7.0
341: X-rw-r--r-- 1 deraadt wheel 16665 Jun 18 09:50 libgssapi.so.1.0
342: X-rw-r--r-- 1 deraadt wheel 86198 Jun 18 09:50 libkafs.so.10.0
343: X-rw-r--r-- 1 deraadt wheel 42254 Jun 18 09:50 libkrb.so.10.0
344: X-rw-r--r-- 1 deraadt wheel 66099 Jun 18 09:50 libkrb5.so.4.0
345: X-rw-r--r-- 1 deraadt wheel 387976 Jun 18 09:50 libz.so.1.4
1.3 deraadt 346: X
347: Xusr/libexec:
348: Xtotal 100
349: Xdrwxr-xr-x 2 deraadt wheel 512 Nov 29 1995 ./
350: Xdrwxr-xr-x 5 deraadt wheel 512 Nov 30 1995 ../
351: X-rwxr-xr-x 1 deraadt wheel 49152 Jun 18 09:47 ld.so*
352: X
353: X[eap anoncvs 14 ]> ls cvs
354: XCVSROOT/ src/ sup/ www/
1.6 deraadt 355: X[eap anoncvs 15 ]> cd /open
1.3 deraadt 356: X[eap anoncvs 16 ]> ls -alF sup
357: Xtotal 8
358: Xdrwxrwxr-x 3 deraadt wheel 512 Dec 4 1995 ./
359: Xdrwxr-xr-x 7 root wheel 512 Feb 20 09:58 ../
360: Xdrwxr-xr-x 2 deraadt wheel 512 Jun 22 06:05 cvs/
361: X-rw-rw-r-- 1 deraadt wheel 54 Dec 4 1995 ss
362: X
363: X
1.7 beck 364: X***************************************************************
365: XNOTES FOR OTHER PLATFORMS:
366: X
367: XIf you're not that familiar with your other platform (i.e. you haven't
1.13 millert 368: Xbuilt a chroot jail for a server on it) you may be better off
1.16 millert 369: Xfinding an OpenBSD machine to use and duplicating the example above.
1.7 beck 370: X
371: X**SunOS 5)
1.10 beck 372: XBob Beck <Bob.Beck@ualberta.ca> has done this. E-mail for
1.7 beck 373: Xhelp if you need it.
1.6 deraadt 374: X
1.7 beck 375: X**OSF 1)
1.6 deraadt 376: XFrom Todd Fries <toddf@acm.org> to the adventurous.
377: XA note for those installing anoncvs on non-OpenBSD operating systems.
378: XYou are in for some fun.
379: X
380: XFor OSF1, on a DEC alpha, I had to do the following in addition to the
381: Xabove:
382: X
383: X- I do not know how to setup dynamic libraries on osf1 and as a result
384: X everything had to be compiled statically.
385: X- Therefore, everything but /bin/sh I had to recmpile in order to
386: X get the chroot setup. In order that there be no guesswork
387: X involved, the following packages' binaries must exist in the chroot
388: X environment:
389: X
390: X GNU
391: X cvs (from the OpenBSD source tree)
392: X
393: XSome notes on compiling.
394: X
395: X cvs fails to install if you don't have makeinfo ... just search for the
396: X string ' install-info$' with regex and remove it from the Makefile for the
397: X install and you'll be fine, or install 'texinfo', your choice.
1.1 deraadt 398: END-of-README
399: echo x - anoncvssh.c
400: sed 's/^X//' >anoncvssh.c << 'END-of-anoncvssh.c'
401: X/*
1.15 millert 402: X * Copyright (c) 2002 Todd C. Miller <Todd.Miller@courtesan.com>
403: X * Copyright (c) 1997 Bob Beck <beck@obtuse.com>
404: X * Copyright (c) 1996 Thorsten Lockert <tholo@sigmasoft.com>
405: X *
406: X * Permission to use, copy, modify, and distribute this software for any
407: X * purpose with or without fee is hereby granted, provided that the above
408: X * copyright notice and this permission notice appear in all copies.
409: X *
410: X * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
411: X * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
412: X * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
413: X * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
414: X * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
415: X * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
416: X * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1.1 deraadt 417: X */
418: X
1.4 deraadt 419: X#include <stdio.h>
420: X#include <stdlib.h>
421: X#if defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD__)
422: X#include <paths.h>
423: X#endif
424: X#include <pwd.h>
425: X#include <unistd.h>
426: X#include <sys/types.h>
427: X
428: X#ifndef __P
429: X#if defined(__STDC__) || defined(__cplusplus)
430: X#define __P(protos) protos /* full-blown ANSI C */
431: X#else
432: X#define __P(protos) () /* traditional C preprocessor */
433: X#endif
434: X#endif
435: X
436: X/*
437: X * You may need to change this path to ensure that RCS, CVS and diff
438: X * can be found
439: X */
440: X#ifndef _PATH_DEFPATH
441: X#define _PATH_DEFPATH "/bin:/usr/bin"
442: X#endif
443: X
444: X/*
445: X * This should not normally have to be changed
446: X */
447: X#ifndef _PATH_BSHELL
448: X#define _PATH_BSHELL "/bin/sh"
449: X#endif
450: X
451: X/*
452: X * Location of CVS tree, relative to the anonymous CVS user's
453: X * home directory
454: X */
455: X#ifndef LOCALROOT
456: X#define LOCALROOT "/cvs"
457: X#endif
458: X
459: X/*
460: X * Account and host name to be used when accessing the
461: X * CVS repository remotely
462: X */
463: X#ifndef HOSTNAME
464: X#define HOSTNAME "anoncvs@anoncvs1.usa.openbsd.org"
465: X#endif
466: X
467: X/*
468: X * $CVSROOT is created based on HOSTNAME and LOCALROOT above
469: X */
1.1 deraadt 470: X#ifndef CVSROOT
1.17 espie 471: X#define CVSROOT HOSTNAME ":"LOCALROOT
1.1 deraadt 472: X#endif
473: X
1.8 beck 474: X/*
475: X * We define PSERVER_SUPPORT to allow anoncvssh to spawn a "cvs pserver".
476: X * You may undefine this if you aren't going to be running pserver.
477: X */
478: X#ifndef PSERVER_SUPPORT
479: X#define PSERVER_SUPPORT
480: X#endif
481: X
482: X/*
483: X * Define USE_SYSLOG if you want anoncvssh to log pserver connections
484: X * using syslog()
485: X */
486: X#define USE_SYSLOG
487: X
488: X#ifdef USE_SYSLOG
489: X#include <string.h>
490: X#include <syslog.h>
491: X#include <netinet/in.h>
492: X#include <sys/socket.h>
493: X#include <arpa/inet.h>
494: X#define LOG_FACILITY LOG_DAEMON
495: X#define LOG_PRIO LOG_INFO
496: X#endif
497: X
498: X/* Define ANONCVS_USER if you want anoncvssh to complain if invoked by
499: X * anyone other than root or ANONCVS_USER.
500: X */
501: X/* #define ANONCVS_USER "anoncvs" */
502: X
1.4 deraadt 503: Xint main __P((int, char *[]));
504: X
505: Xchar * const env[] = {
1.17 espie 506: X "PATH="_PATH_DEFPATH,
507: X "SHELL="_PATH_BSHELL,
508: X "CVSROOT="LOCALROOT,
1.4 deraadt 509: X "HOME=/",
510: X "CVSREADONLYFS=1",
511: X NULL
512: X};
1.1 deraadt 513: X
514: Xint
515: Xmain(argc, argv)
516: Xint argc;
517: Xchar *argv[];
518: X{
519: X struct passwd *pw;
1.5 deraadt 520: X#ifdef DEBUG
521: X int i;
522: X#endif /* DEBUG */
1.1 deraadt 523: X
524: X pw = getpwuid(getuid());
525: X if (pw == NULL) {
526: X fprintf(stderr, "no user for uid %d\n", getuid());
527: X exit(1);
528: X }
529: X if (pw->pw_dir == NULL) {
530: X fprintf(stderr, "no directory\n");
531: X exit(1);
532: X }
1.8 beck 533: X
534: X#ifdef USE_SYSLOG
535: X openlog("anoncvssh", LOG_PID | LOG_NDELAY, LOG_FACILITY);
536: X#endif /* USE_SYSLOG */
537: X
538: X#ifdef ANONCVS_USER
539: X /*
540: X * I love lusers who have to test every setuid binary on my machine.
541: X */
542: X if (getuid() != 0 && (strcmp (pw->pw_name, ANONCVS_USER) != 0)) {
543: X fprintf(stderr, "You're not supposed to be running me!\n");
544: X#ifdef USE_SYSLOG
545: X syslog(LOG_NOTICE,
546: X "User %s(%d) invoked anoncvssh - Possible twink?",
547: X pw->pw_name, pw->pw_uid);
548: X#endif /* USE_SYSLOG */
549: X exit(1);
550: X }
551: X#endif /* ANONCVS_USER */
552: X
553: X
1.11 millert 554: X setuid(0);
1.1 deraadt 555: X if (chroot(pw->pw_dir) == -1) {
556: X perror("chroot");
557: X exit (1);
558: X }
559: X chdir("/");
1.11 millert 560: X setuid(pw->pw_uid);
1.1 deraadt 561: X
562: X /*
563: X * program now "safe"
564: X */
1.6 deraadt 565: X
1.8 beck 566: X#ifdef PSERVER_SUPPORT
1.6 deraadt 567: X /* If we want pserver functionality */
1.8 beck 568: X if ((argc == 2) && (strcmp("pserver", argv[1]) == 0)) {
569: X#ifdef USE_SYSLOG
570: X int slen;
571: X struct sockaddr_in my_sa, peer_sa;
572: X char *us, *them;
573: X
574: X slen = sizeof(my_sa);
575: X if (getsockname(0, (struct sockaddr *) &my_sa, &slen)
576: X != 0) {
577: X perror("getsockname");
578: X exit(1);
579: X }
580: X us = strdup(inet_ntoa(my_sa.sin_addr));
581: X if (us == NULL) {
582: X fprintf(stderr, "malloc failed\n");
583: X exit(1);
584: X }
585: X slen = sizeof(peer_sa);
586: X if (getpeername(0, (struct sockaddr *) &peer_sa, &slen)
587: X != 0) {
588: X perror("getpeername");
589: X exit(1);
590: X }
591: X them=strdup(inet_ntoa(peer_sa.sin_addr));
592: X if (them == NULL) {
593: X fprintf(stderr, "malloc failed\n");
594: X exit(1);
595: X }
596: X syslog(LOG_PRIO,
597: X "pserver connection from %s:%d to %s:%d\n",
598: X them, ntohs(peer_sa.sin_port),
599: X us, ntohs(my_sa.sin_port));
600: X#endif /* USE_SYSLOG */
1.11 millert 601: X execle("/usr/bin/cvs", "cvs",
1.17 espie 602: X "--allow-root="LOCALROOT, "pserver", (char *)NULL, env);
1.6 deraadt 603: X perror("execle: cvs");
604: X fprintf(stderr, "unable to exec CVS pserver!\n");
605: X exit(1);
606: X /* NOTREACHED */
607: X }
1.8 beck 608: X#endif
1.1 deraadt 609: X
610: X if (argc != 3 ||
611: X strcmp("anoncvssh", argv[0]) != 0 ||
612: X strcmp("-c", argv[1]) != 0 ||
1.5 deraadt 613: X (strcmp("cvs server", argv[2]) != 0 &&
1.17 espie 614: X strcmp("cvs -d "LOCALROOT" server", argv[2]) != 0)) {
1.1 deraadt 615: X fprintf(stderr, "\nTo use anonymous CVS install the latest ");
616: X fprintf(stderr,"version of CVS on your local machine.\n");
617: X fprintf(stderr,"Then set your CVSROOT environment variable ");
618: X fprintf(stderr,"to the following value:\n");
619: X fprintf(stderr,"\t%s\n\n", CVSROOT);
1.5 deraadt 620: X#ifdef DEBUG
621: X fprintf(stderr, "argc = %d\n", argc);
622: X for (i = 0 ; i < argc ; i++)
623: X fprintf(stderr, "argv[%d] = \"%s\"\n", i, argv[i]);
624: X#endif /* DEBUG */
1.1 deraadt 625: X sleep(10);
626: X exit(0);
627: X }
1.16 millert 628: X execle("/usr/bin/cvs", "cvs", "server", (char *)NULL, env);
1.4 deraadt 629: X perror("execle: cvs");
1.1 deraadt 630: X fprintf(stderr, "unable to exec CVS server!\n");
631: X exit(1);
1.5 deraadt 632: X /* NOTREACHED */
1.1 deraadt 633: X}
634: X
635: END-of-anoncvssh.c
636: exit
637:
![[BACK]](/icons/back.gif){kind=icon}
Return to anoncvs.shar CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www