Ubuntu Manpage: cvstrac - Low-ceremony bug tracker for projects under CVS

NAME

       cvstrac - Low-ceremony bug tracker for projects under CVS

SYNOPSIS

       cvstrac [ command [ params ... ] ... ]

DESCRIPTION

       The cvstrac command is used to run the CVSTrac web service, or to initialise new databases for projects.

       Please  read the section titled Security and Setup for details of the default password and why you should
       change it.

       This manual page was written for the Debian distribution because the original program source does contain
       a     manual     page.    However    CVSTrac    is    well    documented    at    the    CVSTrac    Wiki,
       <http://www.cvstrac.org/cvstrac/wiki>, and you will be able to fin d more up-to-date information there.

OPTIONS

Running cvstrac without options produces a usage message. A summary of the command sequences which can be
passed to cvstrac is included below. For more details, see /usr/share/doc/cvstrac on this system.

chroot dir user
Tells cvstrac to put itself into the chroot gaol dir and switch to the named user, dropping root
privileges. These three parameters must be the first passed to cvstrac, and processing of command
line parameters continues as normal after the chroot.

init dir project
Initialises a new CVSTrac database. dir is the name of the directory in which you want the
database to reside, and project is the name of the project that CVSTrac will be hosting. The
database file will be created as dir/project.db

The following parameters cause CVSTrac to begin responding to HTTP requests by various methods. You will
need to set up the database before use to ensure that only authorised users have administrative access.
PLEASE READ and understand the section below entitled Security and Setup before using these commands,
because unless you understand what to do you'll be leaving your system vulnerable to arbitrary code
execution as the user invoking CVSTrac.

http dir [ project ]
Causes CVSTrac to start running as an HTTP server on the standard input, displaying responses to
the standard out. dir should be the name of a directory holding project database or databases
created by cvstrac init and project is the name of a project database without the ".db" extension,
as for cvstrac init. If the latter option is given, access is restricted to just the named
project DB, and the access URL will change slightly. See below for details.

cgi dir [ project ]
Causes CVSTrac to respond as a CGI script. dir and project are interpreted as for cvstrac http.
This invocation can be installed into a simple shell or Perl CGI script anywhere on a server
supporting the Common Gateway Interface.

server port dir [ project ]
Causes CVSTrac to run as a self-hosted HTTP server on the specified port. dir and project are
interpreted as above.

Access to CVSTrac

       CVSTrac accesses databases created by its own init command, and is accessed remotely by HTTP. If you  did
       not  specify  a  single  project  to access in any of the http, cgi, or server commands, then the running
       CVSTrac instance can be used to access any database in that directory simply by modifying  the  URL,  but
       you will need to supply the name of the database in order to access it.

       For  self-hosted server instances of CVSTrac, and http instances started from inetd, the URL to use is of
       the form

              http://hostname[:port]/

       if you specified a project in the invocation, or

              http://hostname[:port]/project/

       if you didn't.

       If running as a CGI script, simply use the URL you would normally  use  for  the  CGI  script,  with  the
       project name you wish to access tacked on if necessary, as above.

       For details of the default password, and why you should change it, read on!

Security and Setup

       Once CVSTrac is installed and running, you should immediately access it as the setup user, and change the
       password.  The  username  and  password  of  the  setup  user  are  both   "setup".   Passwords,   rather
       counterintuitively, are changed by following the "Logout" hyperlink at the bottom of the main menu on the
       start screen.

       The setup user is able, in normal operation, to configure the service in a way that can  cause  arbitrary
       code  to  be  executed under the same userid as CVSTrac itself. You should be aware of this, and the fact
       that this can easily lead to more serious exploits if the setup user is compromised.

       The chroot functionality described above is not a perfect fix for this, but can be used as an  additional
       security  measure.  See  the section below entitled Runtime Dependencies for details of what binaries the
       chroot gaol will need.

Access to the CVS repository

       CVSTrac should be installed running as a user with read access to the CVS repository specified during the
       interactive  setup.  Certain  commands,  such  as  the ability to modify CVSROOT/passwd require the write
       permissions too.

Runtime Dependencies

       Besides its libraries, CVSTrac requires the following binaries by default: co, rcsdiff,  rlog  and  diff.
       If  running  cvstrac  on  a  Debian system, these will have been installed as dependencies of the cvstrac
       package, or as part of the base system.

AUTHOR

       This manual page was written by Andrew Chadwick <andrewc@piffle.org>, for  the  Debian  GNU/Linux  system
       (but may be used by others).