
	HOW TO INSTALL CVS-nserver with virtual repositories support.

+ Download cvs-nserver code from 

	http://alexm.here.ru/cvs-nserver/download/

You need the latest version, not earlier than 1.10.8.4 (preferably
1.11.1.x).


+ Compile:
	$ tar zxf cvs-nserver-1.11.1.1.tar.gz
	$ cd cvs-nserver-1.11.1.1/
	$ ./configure --enable-setuid
	$ make

+ cvspasswd program will be built and installed (it's a helper to
  support changing passwords by ordinary users).  It'll get installed
  setuid 'cvsadmin' user, with group 'cvs' and permissions of 4750.
  This means that only users in group 'cvs' will be able to execute
  this program.

+ Create system accounts that would own your first virtual repository.

  - Create group 'cvsadmin'. Create user 'cvsadmin' with primary group
    'cvsadmin'.  

  - Create group 'cvs'.  There would be no ordinary users (especially
    local) in this group.  Create user 'cvs' with primary group
    'cvs'.  Put 'cvsadmin' user into 'cvs' group by editing
    '/etc/group'. 

    _NO_ real user should belong to 'cvs' group!  Only 'cvsadmin' and
    'cvs' users should belong there.

You can change user and/or group of the installed 'cvspasswd' by
providing parameter to '--enable-setuid' flag of 'configure':

	$ ./configure --enable-setuid=otheruser:othergroup

or

	$ ./configure --enable-setuid=otheruser


+ Install all programs:
	# make install


+ Put proper permissions on top-level directory:

  - Anyone in group 'cvs' can create new subdirectories under
    /repos1.  The leading '3' in '3775' (setgid + sticky bit) means
    that a) newly created subdirectories will have the same group
    'cvs' (this is known as "BSD-groups" behaviour) and b) that no one
    will be able to rename or delete others's top-level projects
    (including CVSROOT).  If your partition where '/repos1' resides is
    already mounted with 'bsdgroups' mount option, then you can use
    simply '1755' instead:

	# chown cvsadmin.cvs /repos1
	# chmod 3775 /repos1


+ Create the repository: 

	# /usr/local/bin/cvs -d /repos1 init


+ Put proper permissions on directories below top-level:

   - Only 'cvsadmin' can modify anything in CVSROOT:
	# chown -R cvsadmin.cvsadmin /repos1/CVSROOT
	# chmod 755 /repos1/CVSROOT
	# chmod 444 /repos1/CVSROOT/*

   - Except for 'history' and 'val-tags' files, which should be
     writable by anyone with access to this repository:
	# touch /repos1/CVSROOT/history
	# chown cvs.cvsadmin /repos1/CVSROOT/history
	# chmod 664 /repos1/CVSROOT/history
	# touch /repos1/CVSROOT/val-tags
	# chown cvs.cvsadmin /repos1/CVSROOT/val-tags
	# chmod 664 /repos1/CVSROOT/val-tags
	


+ Now you can create the administrator for this repository who will
manage repository however he wishes, not bothering you no more.

	Currently all passwords are being transmitted over the wire 
	(and on Internet!) in clear text open for anyone to read.
	When cvs-nserver will support pserver-over-SSL this will not
	be the case, but for now you have to seriously consider your
	conditions and decide for yourself whether it is acceptable
	for you. 

	Note althought that half of important OpenSource projects are
	being developed that way :)


	# cvs -d /repos1 passwd -a cvsadmin -u cvsadmin.cvsadmin -m admin@example.com
	Enter CVS password for user admin: ********
	Enter CVS password for user admin again: ********
	# cvs -d /repos1 passwd -e admin
	Enabling user admin

As you are working under root, you now have to change the owner of
'cvspasswd' file to cvsadmin:

	# chown cvsadmin.cvsadmin /repos1/CVSROOT/cvspasswd

Now the admin of this repository could do (over the network):

	$ cvs -d :pserver:admin@cvs.example.com:/repos1 login

And start adding, removing, enabling, disabling and changing users as
he wishes:

	$ cvs -d :pserver:admin@cvs.example.com:/repos1 passwd -a vasya -u cvs.cvs -m vasya@example.com
	$ cvs -d :pserver:admin@cvs.example.com:/repos1 passwd -e vasya

Please note "-u cvs.cvs" part.  It specifies user and group that will
be used on server machine when that virtual user (vasya) will use the
remote repository.

*** TODO: currently remote admin can provide any "-u" values, for example, 
"-u root.root".  This will change very soon. ***  Right now you have
to trust your remote cvsadmin. 

+ You can stay away from remote management if you wish and add all
necessary users yourself:

	# cvs -d /repos1 passwd -a vasya -u cvs.cvs -e vasya@example.com
	# chown cvsadmin.cvsadmin /repos1/CVSROOT/cvspasswd

The latter command is needed if you'll ever enable remote management
again, so that cvsadmin had permissions to modify this file.

+ You can allow your user to change their passwords themselves if you
have installed 'cvspasswd' program described above.  Just

	# touch /repos1/CVSROOT/allow-cvspasswd

And tell your users about

	$ cvs -d :pserver:vasya@cvs.example.com:/repos1 passwd -p


+ Passwords for virtual users are kept in CVSROOT/cvspasswd file.  It
should be owned by 'cvsadmin.cvsadmin' with permissions '0600'.  To
prevent simultaneous changing of this file, CVSROOT/cvspasswd.lock'
file is used.  It should normally exist no more than a fraction of
second.  If you have troubles using 'cvs passwd', look for that
lock-file, maybe it was left from previous 'cvs passwd' command (as a
result of bug, almost certainly).


+ Installing the network-server.  Create the following script: 

=== /usr/local/bin/repos1pserver ===
#!/bin/sh
CVSPASSWD=/usr/local/bin/cvspasswd \
exec /usr/local/bin/cvs-pserver /repos1 -- \
/usr/local/bin/cvschkpw /usr/local/bin/cvs pserver
=== /usr/local/bin/repos1pserver ===

And add the following line into your '/etc/inetd.conf': 
2401  stream  tcp  nowait  root /usr/local/bin/repos1pserver cvs-pserver


+ Regarding ownership of ,v-files in repository.  Almost always
,v-files in repository will be owned by cvs-user and cvs-group and you
almost always do not need anything else.  (First think about creating
another virtual repository).


+ Regarding several repositories.  You should create a pair of
user-group accounts on server machine.  Let them be called simply:
repos1.repos1, repos2.repos2 and so on. 


How to handle several repositories wrt 'cvspasswd' program: We could
create the appropriate users and groups: repos1admin.repos1admin,
repos2admin.repos2admin, etc.  The 'cvspasswd' program gets installed
setuid root.  There is a hardcoded configuration file
/etc/cvspasswd.conf, containing lines like:

    /repos1 repos1admin:repos1admin
    /repos2 repos2admin:repos2admin
    /repos3 repos3admin:repos3admin

When the cvspasswd program is run by the ordinary user (running under
repoN.reposN, where every reposN user is in the 'cvs' group), it reads
the configuration file and setuids to the appropriate user/group.
Afterwards it modifies the CVSROOT/cvspasswd file.

This probably should be made the default behaviour.


If you have noticed a bug or mis-feature in this document or while
using cvs-nserver with virtual repositories, subscribe to cvs-nserver
mailing list and report your problems (or write to me directly). All
related information is available at

	http://alexm.here.ru/cvs-nserver/

Watch and pray!
