From: Petr Baudis <pasky@suse.cz>
Date: Thu, 14 Aug 2008 08:23:45 GMT
Subject: Re: [RFC] Adding a challenge-response authentication method to git://
Message-ID: <20080814082345.GQ10151@machine.or.cz>
In-Reply-To: <20080814074805.GA21577@linode.davidb.org>

On Thu, Aug 14, 2008 at 12:48:05AM -0700, David Brown wrote:
> On Wed, Aug 13, 2008 at 06:36:46PM +0200, Petr Baudis wrote:
>> On Wed, Aug 13, 2008 at 06:26:44PM +0200, Stephen R. van den Berg wrote:
>>> What are the opinions on adding a basic challenge-response type
>>> authentication mechanism to the native git protocol?
>>> I.e. the authentication would be a simple one, which uses
>>> SHA1 (surprise ;-) to actually encrypt username/password/salt
>>> and authenticate the user.
>>
>> In the past, such an idea was dismissed with desire not to reimplement
>> something ssh already implemented, and much better than we would.
>
> The problem is that ssh ties you in very closely with the ability to
> log into the machine.  It's also hard to limit what ssh allows while
> still allowing some users more priveleges.

Can you elaborate, in light of git-shell and Gitosis? What's the
problem?

				Petr "Pasky" Baudis