Does pclcvs support ssh protocol ?

Does pclcvs support ssh protocol ?

[Pierre Lorenzon]

Hi All,

I am very surprised that none seems to have an answer to this
so simple question : "does pclcvs support ssh protocol ?" Using
cvs client side, if you set the environment variable CVS_RSH to
ssh, cvs will use ssh to communicate with the server. Does
pclcvs support this feature ?

Sorry but I think I read the documentation enough carefully and
never saw that pclcvs supports ssh neither that it does not !
So what ? If it does I must understantd why it does not work on
my system ; but if it does not I simply have to find another
solution or hack the code ! 

Thus sometimes the code itself is the best documentation but I
thought that it could be faster to try to get an answer on this
list rather to investigate the code. 

Best 

Pierre

Re: Does pclcvs support ssh protocol ?

[Michael Hoffman]

Pierre Lorenzon wrote:

> I am very surprised that none seems to have an answer to this
> so simple question : "does pclcvs support ssh protocol ?" Using
> cvs client side, if you set the environment variable CVS_RSH to
> ssh, cvs will use ssh to communicate with the server. Does
> pclcvs support this feature ?

It's just a front-end to CVS, so it doesn't affect whether your local 
CVS installation supports ssh or not.

Does it work under VC? What error messages do you get?

Re: Does pclcvs support ssh protocol ?

[Pierre Lorenzon]

From: Michael Hoffman <b3i4old02@sneakemail.com>
Subject: Re: Does pclcvs support ssh protocol ?
Date: Thu, 21 Feb 2008 11:38:17 +0000

> Pierre Lorenzon wrote:
> 
> > I am very surprised that none seems to have an answer to this
> > so simple question : "does pclcvs support ssh protocol ?" Using
> > cvs client side, if you set the environment variable CVS_RSH to
> > ssh, cvs will use ssh to communicate with the server. Does
> > pclcvs support this feature ?
> 
> It's just a front-end to CVS, so it doesn't affect whether your local 
> CVS installation supports ssh or not.

  Not exactly ! Since ssh transaction requires an interactive
  sequence during which password is required and send ! Hence
  if such a dialog is not allowed by pclcvs is wouldn't work !
  That exactly what append : when I issue # cvs up in the
  consol ssh password is required but when I try to use pclcvs
  instead NOTHING is required AT ANYTIME !!! and *cvs* buffer
  contains : 

Repository : :ext:root@jabberwocky:/web/srv/sources/cvs
Module     : lorenzon/Mathematique
Working dir: ~/Mathematique/



Message: cvs [update aborted]: end of file from server (consult above messages if any)
Message: Connection closed by 192.168.0.5

--------------------- Empty ---------------------
-- last cmd: cvs -f -n update -d -P --

I issued PRECISELY the same command as above in the consol and
it WORKS PERFECTLY !!! 

Pierre

Re: Does pclcvs support ssh protocol ?

[Michael Albinus]

Pierre Lorenzon <devel@pollock-nageoire.net> writes:

>   Not exactly ! Since ssh transaction requires an interactive
>   sequence during which password is required and send ! Hence
>   if such a dialog is not allowed by pclcvs is wouldn't work !

You can use ssh-agent.

> Pierre

Best regards, Michael.

Re: Does pclcvs support ssh protocol ?

[Michael Hoffman]

Pierre Lorenzon wrote:

>   Not exactly ! Since ssh transaction requires an interactive
>   sequence during which password is required and send ! Hence
>   if such a dialog is not allowed by pclcvs is wouldn't work !
>   That exactly what append : when I issue # cvs up in the
>   consol ssh password is required but when I try to use pclcvs
>   instead NOTHING is required AT ANYTIME !!! and *cvs* buffer
>   contains : 

Please calm down.

My copy of OpenSSH does not seem to support password input from a device 
that is not a terminal (such as the Emacs pipe I presume is setting this 
up).

The best thing to do would be to set up public key authentication so you 
do not need to type in passwords all the time.

> Repository : :ext:root@jabberwocky:/web/srv/sources/cvs

Logging in as root for routine uses like this is not a good idea.

Re: Does pclcvs support ssh protocol ?

[Pierre Lorenzon]

From: Michael Hoffman <b3i4old02@sneakemail.com>
Subject: Re: Does pclcvs support ssh protocol ?
Date: Thu, 21 Feb 2008 16:21:31 +0000

> Pierre Lorenzon wrote:
> 
> >   Not exactly ! Since ssh transaction requires an interactive
> >   sequence during which password is required and send ! Hence
> >   if such a dialog is not allowed by pclcvs is wouldn't work !
> >   That exactly what append : when I issue # cvs up in the
> >   consol ssh password is required but when I try to use pclcvs
> >   instead NOTHING is required AT ANYTIME !!! and *cvs* buffer
> >   contains : 
> 
> Please calm down.
> 
> My copy of OpenSSH does not seem to support password input from a device 
> that is not a terminal (such as the Emacs pipe I presume is setting this 
> up).


  Notice that password transaction works perfectly good with
  tramp so that's not the problem ! 
> 
> The best thing to do would be to set up public key authentication so you 
> do not need to type in passwords all the time.

     Once would probably be enough just like with tramp. 

> 
> > Repository : :ext:root@jabberwocky:/web/srv/sources/cvs
> 
> Logging in as root for routine uses like this is not a good
> idea.

  I know that ! thank you but it was only for test and in an
  local network ! I will not modify the whole system
  architecture for something that does not work !

  Notice that I still do not have the answer to my question :
  "yes or not is this password transaction implemented in
  pcl-cvs like in tramp ?"

  Pierre
> 
> 
> 

Re: Does pclcvs support ssh protocol ?

[Michael Hoffman]

Pierre Lorenzon wrote:

>   Notice that I still do not have the answer to my question :
>   "yes or not is this password transaction implemented in
>   pcl-cvs like in tramp ?"

Now the question has changed.

Re: Does pclcvs support ssh protocol ?

[Pierre Lorenzon]

From: Michael Hoffman <b3i4old02@sneakemail.com>
Subject: Re: Does pclcvs support ssh protocol ?
Date: Thu, 21 Feb 2008 20:31:54 +0000

> Pierre Lorenzon wrote:
> 
> >   Notice that I still do not have the answer to my question :
> >   "yes or not is this password transaction implemented in
> >   pcl-cvs like in tramp ?"
> 
> Now the question has changed.


  Not really ! 

  Pierre

Re: Does pclcvs support ssh protocol ?

[Mike Mattie]

[-- Attachment #1: Type: text/plain, Size: 1361 bytes --]

On Fri, 22 Feb 2008 07:54:09 +0100 (CET)
Pierre Lorenzon <devel@pollock-nageoire.net> wrote:

> From: Michael Hoffman <b3i4old02@sneakemail.com>
> Subject: Re: Does pclcvs support ssh protocol ?
> Date: Thu, 21 Feb 2008 20:31:54 +0000
> 
> > Pierre Lorenzon wrote:
> > 
> > >   Notice that I still do not have the answer to my question :
> > >   "yes or not is this password transaction implemented in
> > >   pcl-cvs like in tramp ?"
> > 
> > Now the question has changed.
> 
> 
>   Not really ! 
> 
>   Pierre
> 
> 
> 

The answer is clearly ssh-agent. There are a large number of security issues regarding keys,
memory locking, timed expiration, secure entry, etc. Emacs doesn't need to jump through all these
hoops when ssh-agent,pin-entry,gpg do this sort of thing correctly with a robust code-base.

I can't even imagine why someone would want to constantly re-enter the password anyways.

If you were interested in security you would not want your security critical components exposed
in a monolith like Emacs that cannot enforce memory privileges.

Hammering away at this issue is asinine, since you do not have a point. Thanks to these fancy
link-loader gizmos, and those operating system thingies we can distribute functionality across
process boundaries with IPC. Welcome to the revolution.

Cheers,
Mike Mattie

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Enlarging the question Was: Re: Does pclcvs support ssh protocol ?

[Pierre Lorenzon]

From: Mike Mattie <codermattie@gmail.com>
Subject: Re: Does pclcvs support ssh protocol ?
Date: Thu, 21 Feb 2008 23:11:56 -0800

> On Fri, 22 Feb 2008 07:54:09 +0100 (CET)
> Pierre Lorenzon <devel@pollock-nageoire.net> wrote:
> 
> > From: Michael Hoffman <b3i4old02@sneakemail.com>
> > Subject: Re: Does pclcvs support ssh protocol ?
> > Date: Thu, 21 Feb 2008 20:31:54 +0000
> > 
> > > Pierre Lorenzon wrote:
> > > 
> > > >   Notice that I still do not have the answer to my question :
> > > >   "yes or not is this password transaction implemented in
> > > >   pcl-cvs like in tramp ?"
> > > 
> > > Now the question has changed.
> > 
> > 
> >   Not really ! 
> > 
> >   Pierre
> > 
> > 
> > 
> 
> The answer is clearly ssh-agent. There are a large number of security issues regarding keys,
> memory locking, timed expiration, secure entry, etc. Emacs doesn't need to jump through all these
> hoops when ssh-agent,pin-entry,gpg do this sort of thing
> correctly with a robust code-base.

  Yes ! do you mean that tramp for instance uses ssh-agent ? It
  might be ; I didn't examine the code to answer this question
  ...

  Bests

  Pierre

Re: Enlarging the question Was: Re: Does pclcvs support ssh protocol ?

[Thierry Volpiatto]

Pierre Lorenzon <devel@pollock-nageoire.net> writes:

> From: Mike Mattie <codermattie@gmail.com>
> Subject: Re: Does pclcvs support ssh protocol ?
> Date: Thu, 21 Feb 2008 23:11:56 -0800
>
>> On Fri, 22 Feb 2008 07:54:09 +0100 (CET)
>> Pierre Lorenzon <devel@pollock-nageoire.net> wrote:
>> 
>> > From: Michael Hoffman <b3i4old02@sneakemail.com>
>> > Subject: Re: Does pclcvs support ssh protocol ?
>> > Date: Thu, 21 Feb 2008 20:31:54 +0000
>> > 
>> > > Pierre Lorenzon wrote:
>> > > 
>> > > >   Notice that I still do not have the answer to my question :
>> > > >   "yes or not is this password transaction implemented in
>> > > >   pcl-cvs like in tramp ?"
>> > > 
>> > > Now the question has changed.
>> > 
>> > 
>> >   Not really ! 
>> > 
>> >   Pierre
>> > 
>> > 
>> > 
>> 
>> The answer is clearly ssh-agent. There are a large number of security issues regarding keys,
>> memory locking, timed expiration, secure entry, etc. Emacs doesn't need to jump through all these
>> hoops when ssh-agent,pin-entry,gpg do this sort of thing
>> correctly with a robust code-base.
>
>   Yes ! do you mean that tramp for instance uses ssh-agent ? It
>   might be ; I didn't examine the code to answer this question
>   ...

Yes tramp use ssh-agent, if ssh-agent is started; if not you are prompted for a
passphrase (you have to create keys and use keys system, not password).
I don't use cvs for my files, i use svn.
With svn if you do your checkout throught ssh, and ssh-agent+keys system is
enabled, when you commit the change in your file, svn use automaticly ssh with
tramp.
So you have to do your initial co with ssh.
I suppose it is the same with cvs ?
Anyway, using ssh with keys and ssh-agent is the best for all (cvs, svn, or
anything else)
One thing you can do also is using sshfs:
You can mount the file system where your cvs repo is and then commit locally your
changes.(thought not all server autorize that)

-- 
A + Thierry
Pub key: http://pgp.mit.edu

Re: Enlarging the question Was: Re: Does pclcvs support ssh protocol ?

[Xavier Maillard]

Hi,

   One thing you can do also is using sshfs:

I tried in the past this solution and the performance were so bad
that I revert my choice after 1 day or so. The same applies for
the ftp FUSE project. I found that even tramp could outperform
FUSE at this :)

	Xavier
-- 
http://www.gnu.org
http://www.april.org
http://www.lolica.org

Re: Enlarging the question Was: Re: Does pclcvs support ssh protocol ?

[Xavier Maillard]

   Pierre Lorenzon <devel@pollock-nageoire.net> writes:

   > From: Mike Mattie <codermattie@gmail.com>
   > Subject: Re: Does pclcvs support ssh protocol ?
   > Date: Thu, 21 Feb 2008 23:11:56 -0800
   >
   >> On Fri, 22 Feb 2008 07:54:09 +0100 (CET)
   >> Pierre Lorenzon <devel@pollock-nageoire.net> wrote:
   >> 
   >> > From: Michael Hoffman <b3i4old02@sneakemail.com>
   >> > Subject: Re: Does pclcvs support ssh protocol ?
   >> > Date: Thu, 21 Feb 2008 20:31:54 +0000
   >> > 
   >> > > Pierre Lorenzon wrote:
   >> > > 
   >> > > >   Notice that I still do not have the answer to my question :
   >> > > >   "yes or not is this password transaction implemented in
   >> > > >   pcl-cvs like in tramp ?"
   >> > > 
   >> > > Now the question has changed.
   >> > 
   >> > 
   >> >   Not really ! 
   >> > 
   >> >   Pierre
   >> > 
   >> > 
   >> > 
   >> 
   >> The answer is clearly ssh-agent. There are a large number of security issues regarding keys,
   >> memory locking, timed expiration, secure entry, etc. Emacs doesn't need to jump through all these
   >> hoops when ssh-agent,pin-entry,gpg do this sort of thing
   >> correctly with a robust code-base.
   >
   >   Yes ! do you mean that tramp for instance uses ssh-agent ? It
   >   might be ; I didn't examine the code to answer this question
   >   ...

   Yes tramp use ssh-agent, if ssh-agent is started; if not you are prompted for a
   passphrase (you have to create keys and use keys system, not password).
   I don't use cvs for my files, i use svn.
   With svn if you do your checkout throught ssh, and ssh-agent+keys system is
   enabled, when you commit the change in your file, svn use automaticly ssh with
   tramp.

Do you have any good tuto to set this up ? I am one of these lazy
people who'd rather type their password every two minutes ;)
Ssh-agent could save me some precious time. Lat time I read about
this, it was a pain (for me) to understand.

AFAIK, depending on how one is starting GNU Emacs, the setup
changes. I am mostly working from the linux console, GNU Emacs is
launched through a screen server session which I am connecting
with the help of emacsclient.

I even have a system account which default login shell is
/usr/bin/emacs thus I do not see how ssh-agent could be setup in
this case.

Regards

	Xavier
-- 
http://www.gnu.org
http://www.april.org
http://www.lolica.org

Re: Enlarging the question Was: Re: Does pclcvs support ssh protocol ?

[Tim X]

Xavier Maillard <xma@gnu.org> writes:

>    Pierre Lorenzon <devel@pollock-nageoire.net> writes:
>
>    > From: Mike Mattie <codermattie@gmail.com>
>    > Subject: Re: Does pclcvs support ssh protocol ?
>    > Date: Thu, 21 Feb 2008 23:11:56 -0800
>    >
>    >> On Fri, 22 Feb 2008 07:54:09 +0100 (CET)
>    >> Pierre Lorenzon <devel@pollock-nageoire.net> wrote:
>    >> 
>    >> > From: Michael Hoffman <b3i4old02@sneakemail.com>
>    >> > Subject: Re: Does pclcvs support ssh protocol ?
>    >> > Date: Thu, 21 Feb 2008 20:31:54 +0000
>    >> > 
>    >> > > Pierre Lorenzon wrote:
>    >> > > 
>    >> > > >   Notice that I still do not have the answer to my question :
>    >> > > >   "yes or not is this password transaction implemented in
>    >> > > >   pcl-cvs like in tramp ?"
>    >> > > 
>    >> > > Now the question has changed.
>    >> > 
>    >> > 
>    >> >   Not really ! 
>    >> > 
>    >> >   Pierre
>    >> > 
>    >> > 
>    >> > 
>    >> 
>    >> The answer is clearly ssh-agent. There are a large number of security issues regarding keys,
>    >> memory locking, timed expiration, secure entry, etc. Emacs doesn't need to jump through all these
>    >> hoops when ssh-agent,pin-entry,gpg do this sort of thing
>    >> correctly with a robust code-base.
>    >
>    >   Yes ! do you mean that tramp for instance uses ssh-agent ? It
>    >   might be ; I didn't examine the code to answer this question
>    >   ...
>
>    Yes tramp use ssh-agent, if ssh-agent is started; if not you are prompted for a
>    passphrase (you have to create keys and use keys system, not password).
>    I don't use cvs for my files, i use svn.
>    With svn if you do your checkout throught ssh, and ssh-agent+keys system is
>    enabled, when you commit the change in your file, svn use automaticly ssh with
>    tramp.
>
> Do you have any good tuto to set this up ? I am one of these lazy
> people who'd rather type their password every two minutes ;)
> Ssh-agent could save me some precious time. Lat time I read about
> this, it was a pain (for me) to understand.
>
> AFAIK, depending on how one is starting GNU Emacs, the setup
> changes. I am mostly working from the linux console, GNU Emacs is
> launched through a screen server session which I am connecting
> with the help of emacsclient.
>
> I even have a system account which default login shell is
> /usr/bin/emacs thus I do not see how ssh-agent could be setup in
> this case.
>
> Regards
>
> 	Xavier
> -- 
> http://www.gnu.org
> http://www.april.org
> http://www.lolica.org
>

All you need to do to use ssh-agent is ensure that it is started in a
parent process of any sub-processes yo want to use or have the benefit
of the agent in. for example, on Debian systems, this is done as part of
the standard session setup. All I use to do is have a call to
ask-password in my xsession init script. However, if your using gnome
and seahorse, you don't even need to do that anymore. 

If you have /usr/bin/emacs as your login shell and your only running
under the console (not X), then all you would have to do is replace that
with a shell script that  starts ssh-agent and then possibly call
askpassword and then start emacs. 

Its really not that difficult or complex - just remember ssh-agent has
to be run in a parent process of anything you want that should be able
to take advantage of its facilities. 

Tim


-- 
tcross (at) rapttech dot com dot au

Re: Enlarging the question Was: Re: Does pclcvs support ssh protocol ?

[Xavier Maillard]

   Its really not that difficult or complex - just remember ssh-agent has
   to be run in a parent process of anything you want that should be able
   to take advantage of its facilities. 

Although I am a little bit late on that, just a quick message to
thank you. The trick was right and now I am enjoying ssh-agent
facilities everywhere !

Regards

	Xavier
-- 
http://www.gnu.org
http://www.april.org
http://www.lolica.org

Re: Enlarging the question Was: Re: Does pclcvs support ssh protocol ?

[Tim X]

Thierry Volpiatto <thierry.volpiatto@gmail.com> writes:

> Pierre Lorenzon <devel@pollock-nageoire.net> writes:
>
> One thing you can do also is using sshfs:
> You can mount the file system where your cvs repo is and then commit locally your
> changes.(thought not all server autorize that)
>

Actually, sshfs is very nice. I use it a lot. Essentially, its like a
personal NFS over ssh. If you can ssh to a server, you can probably do
sshfs. It has some nice properties, like the ability to automatically
re-establish the connection if it is broken. 

Once you have it running, the sshfs just appears as another mounted
filesystem (with some limitations relating to things like file size
reporting and df etc). 

What I like about it is that I can then operate on things with any tools
I have, not just emacs/tramp/etc. I have a rather extensive emacs
package that I depend on which is very large and frequently it has to be
updated after changes to tramp. As I also use CVS emacs, I find sshfs
extremely useful for those times I've got a bug I've not had time to
work out with tramp - essentially, sshfs can give me the same
functionality.

Tim

-- 
tcross (at) rapttech dot com dot au

Re: Enlarging the question Was: Re: Does pclcvs support ssh protocol ?

[Stefan Monnier]

> One thing you can do also is using sshfs: You can mount the file
> system where your cvs repo is and then commit locally your
> changes.(thought not all server autorize that)

I strongly discourage you from accessing your CVS repository
through sshfs.  A CVS repository accessed through a network file system
will be slow and inefficient, but most importantly it is dangerous
because CVS's locking will most likely not work as it should, so you
risk losing data in your repository.

In many circumstances this risk is tiny (e.g. if there's only ever
1 person accessing the repository and this person only ever uses
a single machine at a time), but there are many other circumstances
where this risk is very real.


        Stefan

Re: Enlarging the question Was: Re: Does pclcvs support ssh protocol ?

[Tim X]

Pierre Lorenzon <devel@pollock-nageoire.net> writes:

> From: Mike Mattie <codermattie@gmail.com>
>
>   Yes ! do you mean that tramp for instance uses ssh-agent ? It
>   might be ; I didn't examine the code to answer this question
>   ...

I think you have things mixed up conceptually. Tramp doesn't need to
know anything about ssh-agent. It simply tries to make a connection over
ssh and ssh-agent handles all the authentication stuff with ssh - tramp
doesn't need to know about ssh-agent. 

I've been using an agent with ssh for a very long time, but I think
tramp will prompt for a password if ssh askes for it. However, since I
have ssh-agent, this never needs to happen with the work I do, so I
could be wrong. 

Someone else mentioned that if your using ssh, then really you should
use ssh-agent. apart from making things a lot simpler, it means your not
typing passwords everytime you make an ssh connection. Typing less
passwords means (usually) better security simply because there is less
opportunity for them to be seen/stolen. 

Setup ssh-agent and the necessary keys and all your questions about
pcl-cvs and ssh will probably just become irrelevant. 

Tim

-- 
tcross (at) rapttech dot com dot au

Re: Does pclcvs support ssh protocol ?

[Tim X]

Michael Hoffman <b3i4old02@sneakemail.com> writes:

> Pierre Lorenzon wrote:
>
>> I am very surprised that none seems to have an answer to this
>> so simple question : "does pclcvs support ssh protocol ?" Using
>> cvs client side, if you set the environment variable CVS_RSH to
>> ssh, cvs will use ssh to communicate with the server. Does
>> pclcvs support this feature ?
>
> It's just a front-end to CVS, so it doesn't affect whether your local CVS
> installation supports ssh or not.
>
> Does it work under VC? What error messages do you get?
>
Not sure if its relevant or not, but the INSTALL file for CVS emacs has
the following note -

,----
| Note on using SSH to access the CVS repository from inside Emacs
| ----------------------------------------------------------------
| 
| Write access to the CVS repository requires using SSH v2.
| 
| If you execute cvs commands inside Emacs, specifically if you use
| pcl-cvs, output from CVS may be lost due to a problem in the
| interface between ssh, cvs, and libc.  Corrupted checkins are
| also known to have happened.
| 
| To fix the problem, save the following script into a file, make it
| executable, and set CVS_RSH to the file name of the script:
| 
| #!/bin/bash
| exec 2> >(exec cat >&2 2>/dev/null)
| exec ssh "$@"
| 
| This may be combined with the following entry in ~/.ssh/config to
| simplify accessing the CVS repository:
| 
| Host subversions.gnu.org
|      Protocol 2
|      ForwardX11 no
|      User YOUR_USERID
`----

Tim


-- 
tcross (at) rapttech dot com dot au

Re: Does pclcvs support ssh protocol ?

[Xavier Maillard]

Hi,

   I am very surprised that none seems to have an answer to this
   so simple question : "does pclcvs support ssh protocol ?" Using
   cvs client side, if you set the environment variable CVS_RSH to
   ssh, cvs will use ssh to communicate with the server. Does
   pclcvs support this feature ?

As previously said, yes.

[As for your questions and the way you answer to people trying to
help you, you shoud take a long breath and calm down. This is not
a hotline and people do their best to answer]

So, once again, I am 100% certain that pcvs *supports* SSH. I
think you have something wrong with your setup or you are
effectivelly facing a bug. In this case, feel free to report it
with M-x report-emacs-bug RET.

Regards,

	Xavier

-- 
http://www.gnu.org
http://www.april.org
http://www.lolica.org

Re: Does pclcvs support ssh protocol ?

[Pierre Lorenzon]

> [As for your questions and the way you answer to people trying to
> help you, you shoud take a long breath and calm down. This is not
> a hotline and people do their best to answer]

  Sure but if people do not have any answer they simply might
  not answer and instead of answering beside the
  question. Otherwise it will be shorter for me to simply look
  at the code if it does the job yes or no. 

  Regards

  Pierre