8.7. The kserver Access Method
The kserver method is used to connect using Kerberos 4. If you do not have an existing Kerberos 4 installation on your CVS repository server, I recommend you use Kerberos 5, described in the preceding section. Kerberos 4 has known weaknesses that Kerberos 5 resolves. This section assumes that you have an existing Kerberos 4 installation and the documentation to configure and use it.
The repository path format for Kerberos is:
The default port for kserver is 1999. If user is not specified, the client sends the username of the calling user on the client computer.
The CVS client and server must both be compiled to run Kerberos 4. If you intend to encrypt the data stream, you also need to have encryption enabled at compile time. You can test whether your CVS program has compiled kserver support by checking the command list, as shown in Example 8-11.
Example 8-11. Testing for kserver mode
You can test for encryption support by checking the options list, as shown earlier in Example 8-9.
To use CVS with kserver, install and configure Kerberos 4 as described in your Kerberos manual. You need to have the header files for Kerberos 4 available for CVS to link to. The principal name for CVS is cvs.
To recompile CVS to support Kerberos 4, follow the instructions in Chapter 2 on installing from source. Use the --with-krb4[=header-files] option to configure to get Kerberos authentication support. Use the Kerberos directory as the argument to --with-krb4. (You need the Kerberos directory you intend to compile against, usually one with include and lib subdirectories.) If you also desire encryption, use --enable-encrypt as well.
CVS needs to run a server on the repository computer to support the kserver access method. Edit inetd.conf and add a line for cvs kserver. See "Using inetd with gserver, kserver, and pserver" later in this chapter for details on how to edit inetd.conf.
Using Kerberos 4, CVS can encrypt the data stream, but it does not do this by default. Use the -x option to encrypt the data stream. You may want to include this option in your .cvsrc file. For example:
To run CVS, get a Kerberos ticket for the user on your client; then call CVS the usual way with the kserver method. Example 8-12 shows how to check out a sandbox using the kserver access method.
Example 8-12. Using the kserver access method