Write access from compile farm

Write access from compile farm

[Daniel Kraft]

Hi,

some time ago I started using the GCC compile farm for development; so 
I'm wondering whether it is ok to have SVN write access from the 
accounts there -- or this is considered insecure.  What are the policies 
there?

As SVN write authentication is done with a public key, I guess that this 
means you have to set the access up appropriately up for any machine I 
want to use for check-in, right?  So... in case the write-access from 
compile farm is ok, can I generate a public key there and submit it to 
you -- or what should I do?

Thanks a lot!  Yours,
Daniel

-- 
http://www.pro-vegan.info/
--
Done:  Arc-Bar-Cav-Kni-Ran-Rog-Sam-Tou-Val-Wiz
To go: Hea-Mon-Pri

Re: Write access from compile farm

[Christopher Faylor]

On Sat, Dec 04, 2010 at 11:18:25AM +0100, Daniel Kraft wrote:
>some time ago I started using the GCC compile farm for development; so 
>I'm wondering whether it is ok to have SVN write access from the 
>accounts there -- or this is considered insecure.  What are the policies 
>there?
>
>As SVN write authentication is done with a public key, I guess that this 
>means you have to set the access up appropriately up for any machine I 
>want to use for check-in, right?  So... in case the write-access from 
>compile farm is ok, can I generate a public key there and submit it to 
>you -- or what should I do?

If you have write access already then just use the private key which you
already have.

cgf

Re: Write access from compile farm

[Hans-Peter Nilsson]

On Sat, 4 Dec 2010, Daniel Kraft wrote:

> some time ago I started using the GCC compile farm for development; so I'm
> wondering whether it is ok to have SVN write access from the accounts there --
> or this is considered insecure.  What are the policies there?
>
> As SVN write authentication is done with a public key, I guess that this means
> you have to set the access up appropriately up for any machine I want to use
> for check-in, right?  So... in case the write-access from compile farm is ok,
> can I generate a public key there and submit it to you -- or what should I do?

Assuming those who set policies don't disagree, and you're
talking about interactive session (i.e. not a cron job or robot)
just forward the *auhentication session*, no need to forge a new
key or deal with copying keys.  Look at what ssh says about its
-A option and ForwardAgent config.  (It might even be the
default for you.)  I'm not sure, but you might have to have
ssh-agent running.

(FWIW, no I wouldn't do that.  I just copy the patch and commit
from my "console" machine.  You say "tin-foil", I say "hats".)

brgds, H-P

Re: Write access from compile farm

[Christopher Faylor]

On Sat, Dec 04, 2010 at 07:21:35PM -0500, Hans-Peter Nilsson wrote:
>On Sat, 4 Dec 2010, Daniel Kraft wrote:
>
>> some time ago I started using the GCC compile farm for development; so I'm
>> wondering whether it is ok to have SVN write access from the accounts there --
>> or this is considered insecure.  What are the policies there?
>>
>> As SVN write authentication is done with a public key, I guess that this means
>> you have to set the access up appropriately up for any machine I want to use
>> for check-in, right?  So... in case the write-access from compile farm is ok,
>> can I generate a public key there and submit it to you -- or what should I do?
>
>Assuming those who set policies don't disagree, and you're
>talking about interactive session (i.e. not a cron job or robot)
>just forward the *auhentication session*, no need to forge a new
>key or deal with copying keys.  Look at what ssh says about its
>-A option and ForwardAgent config.  (It might even be the
>default for you.)  I'm not sure, but you might have to have
>ssh-agent running.

This is actually a better way of doing this than what I suggested since
what I suggested means copying a private key to a semi-public machine.

>(FWIW, no I wouldn't do that.  I just copy the patch and commit
>from my "console" machine.  You say "tin-foil", I say "hats".)

Yeah, ditto, there too.

cgf

Re: Write access from compile farm

[Christopher Faylor]

On Sat, Dec 04, 2010 at 07:21:35PM -0500, Hans-Peter Nilsson wrote:
>On Sat, 4 Dec 2010, Daniel Kraft wrote:
>
>> some time ago I started using the GCC compile farm for development; so I'm
>> wondering whether it is ok to have SVN write access from the accounts there --
>> or this is considered insecure.  What are the policies there?
>>
>> As SVN write authentication is done with a public key, I guess that this means
>> you have to set the access up appropriately up for any machine I want to use
>> for check-in, right?  So... in case the write-access from compile farm is ok,
>> can I generate a public key there and submit it to you -- or what should I do?
>
>Assuming those who set policies don't disagree, and you're
>talking about interactive session (i.e. not a cron job or robot)
>just forward the *auhentication session*, no need to forge a new
>key or deal with copying keys.  Look at what ssh says about its
>-A option and ForwardAgent config.  (It might even be the
>default for you.)  I'm not sure, but you might have to have
>ssh-agent running.

This is actually a better way of doing this than what I suggested since
what I suggested means copying a private key to a semi-public machine.

>(FWIW, no I wouldn't do that.  I just copy the patch and commit
>from my "console" machine.  You say "tin-foil", I say "hats".)

Yeah, ditto, there too.

cgf

Re: Write access from compile farm

[Christopher Faylor]

On Sat, Dec 04, 2010 at 07:21:35PM -0500, Hans-Peter Nilsson wrote:
>On Sat, 4 Dec 2010, Daniel Kraft wrote:
>
>> some time ago I started using the GCC compile farm for development; so I'm
>> wondering whether it is ok to have SVN write access from the accounts there --
>> or this is considered insecure.  What are the policies there?
>>
>> As SVN write authentication is done with a public key, I guess that this means
>> you have to set the access up appropriately up for any machine I want to use
>> for check-in, right?  So... in case the write-access from compile farm is ok,
>> can I generate a public key there and submit it to you -- or what should I do?
>
>Assuming those who set policies don't disagree, and you're
>talking about interactive session (i.e. not a cron job or robot)
>just forward the *auhentication session*, no need to forge a new
>key or deal with copying keys.  Look at what ssh says about its
>-A option and ForwardAgent config.  (It might even be the
>default for you.)  I'm not sure, but you might have to have
>ssh-agent running.

This is actually a better way of doing this than what I suggested since
what I suggested means copying a private key to a semi-public machine.

>(FWIW, no I wouldn't do that.  I just copy the patch and commit
>from my "console" machine.  You say "tin-foil", I say "hats".)

Yeah, ditto, there too.

cgf

Re: Write access from compile farm

[Christopher Faylor]

On Sat, Dec 04, 2010 at 07:21:35PM -0500, Hans-Peter Nilsson wrote:
>On Sat, 4 Dec 2010, Daniel Kraft wrote:
>
>> some time ago I started using the GCC compile farm for development; so I'm
>> wondering whether it is ok to have SVN write access from the accounts there --
>> or this is considered insecure.  What are the policies there?
>>
>> As SVN write authentication is done with a public key, I guess that this means
>> you have to set the access up appropriately up for any machine I want to use
>> for check-in, right?  So... in case the write-access from compile farm is ok,
>> can I generate a public key there and submit it to you -- or what should I do?
>
>Assuming those who set policies don't disagree, and you're
>talking about interactive session (i.e. not a cron job or robot)
>just forward the *auhentication session*, no need to forge a new
>key or deal with copying keys.  Look at what ssh says about its
>-A option and ForwardAgent config.  (It might even be the
>default for you.)  I'm not sure, but you might have to have
>ssh-agent running.

This is actually a better way of doing this than what I suggested since
what I suggested means copying a private key to a semi-public machine.

>(FWIW, no I wouldn't do that.  I just copy the patch and commit
>from my "console" machine.  You say "tin-foil", I say "hats".)

Yeah, ditto, there too.

cgf

Re: Write access from compile farm

[Daniel Kraft]

Hi,

Christopher Faylor wrote:
> On Sat, Dec 04, 2010 at 07:21:35PM -0500, Hans-Peter Nilsson wrote:
>> On Sat, 4 Dec 2010, Daniel Kraft wrote:
>>
>>> some time ago I started using the GCC compile farm for development; so I'm
>>> wondering whether it is ok to have SVN write access from the accounts there --
>>> or this is considered insecure.  What are the policies there?
>>>
>>> As SVN write authentication is done with a public key, I guess that this means
>>> you have to set the access up appropriately up for any machine I want to use
>>> for check-in, right?  So... in case the write-access from compile farm is ok,
>>> can I generate a public key there and submit it to you -- or what should I do?
>> Assuming those who set policies don't disagree, and you're
>> talking about interactive session (i.e. not a cron job or robot)
>> just forward the *auhentication session*, no need to forge a new
>> key or deal with copying keys.  Look at what ssh says about its
>> -A option and ForwardAgent config.  (It might even be the
>> default for you.)  I'm not sure, but you might have to have
>> ssh-agent running.
> 
> This is actually a better way of doing this than what I suggested since
> what I suggested means copying a private key to a semi-public machine.

thanks a lot for the useful tipps!

Yours,
Daniel

-- 
http://www.pro-vegan.info/
--
Done:  Arc-Bar-Cav-Kni-Ran-Rog-Sam-Tou-Val-Wiz
To go: Hea-Mon-Pri

Re: Write access from compile farm

[Christopher Faylor]

Sorry for the duplication.  I don't know why that happened.  Guess it will be interesting
to see if this triggers it too.

cgf