UNIX for Dummies Questions & Answers

Hi,

I know my way around CVS but I am new to ssh tunneling. My boss has asked me to create a ssh tunnel such that when clients connect to the CVS server they do so having ssh encrypt the transmission. All the solutions I have found on the web suggest that ssh tunneling has to be setup on the CLIENT side. My manager insists that we can set up ssh tunneling side on the SERVER side so that we do not have to reconfigure anything client side.

Is this possible? If so, how?

I've never used it with cvs but stunnel can be used to setup a SSL tunnel and it's done on the server side. http://www.stunnel.org. Of course your CVS client would need to support SSL in some way. If not you can setup an SSL tunnel between 2 computers using stunnel. You'd have to set it up on each client machine or use server as the other side of the tunnel and send your traffic through it. The data traveling between the clients and the proxy wouldn't be encrypted of course.

On the page you provide it seems that stunnel has to be setup on server/client side: http://www.stunnel.org/examples/cvs.html

So I guess I am back to square one. Anyone know how to secure CVS by just making server side configurations?

SSL is always client/server side in that the client has to support SSL in order for everything to work. When you connect to a web server via SSL it's because your client supports SSL and the server is setup to create SSL connections with the clients. stunnel can SSL enable just about anything but the client you are connecting to it with must support it. So, in order to do what you want you'll need a SSL enabled CVS client and a SSL enabled CVS server. If your server doesn't support SSL then that support can be added using stunnel. If you have a CVS client that supports SSL you'll be able to make the connection to the server. I did a quick search for CVS clients that support this and I didn't find much but they may be out there.

The other solution I suggested was to tunnel the traffic to and from the CVS server using stunnel. This method wouldn't require a SSL enabled client or server but would require stunnel on both ends. Either using a proxy or by having stunnel on each client machine, assuming they are *NIX based.