Re: Storing /etc in a repository

[Chris Jensen <cj...@edex.com.au>]

>> Actually, shadow, group, passwd, etc... are not being vc-ed, for that
>>very reason.  They're not complex files, and I don't work heavily with
>>them -- so why bother?
> 
> 
> It really depends what you are doing, and what are yours requirements:
> I would be very, very unhappy if some bit fungus eats those files, and
> I had to re-create them from scratch (especially /etc/group).

I don't keep any files with passwords in my repository for security 
reasons. In our environment, this means only ignoring shadow. group and 
passwd don't contain passwords (nor would they in most setups), so they 
should be safe to version.
I'm pretty sure (though have not tested) that you can recreate shadow 
automatically from passwd should you have a catastrophic failure - of 
course you'll lose your passwords, but given it's a server I don't think 
there's more than 2 or 3 passwords in shadow (all other accounts are 
service accounts).

As for how to get /etc into the repository, I did it as per the in place 
import instructions, but added things non-recursively so as to ensure I 
got all the files that should be ignored
eg
# svn st | grep \?
?	passwd
?	shadow
?	apache
...
# svn add -N apache passwd
# svn propedit svn:ignore . (add shadow to the list)


As well as passwords, you probably also want to avoid files that change 
constantly, /etc/mtab and /etc/adjtime are two examples of this, they 
can be recreated by programs and any version in the repository will 
probably be out of date.

In order to make sure the repository is kept up to date, I wrote a cron 
job that runs "svn st -u" daily and sends any output to administrators 
so as to remind them to commit their changes.

-- 
---------------------------------------------------------------------
Chris Jensen cjensen@edex.com.au

Educational Experience (Australia)
Postal Address: PO Box 860, Newcastle NSW 2300
Freecall:       1-800-025 270      International: +61-2-4923 8222
Fax:            (02) 4942 1991     International: +61-2-4942 1991

Visit our online Toy store! http://www.toysandmore.com.au/
---------------------------------------------------------------------

Re: Storing /etc in a repository

["Robert P. J. Day" <rp...@mindspring.com>]

On Wed, 5 Jan 2005, Chris Jensen wrote:

> > > Actually, shadow, group, passwd, etc... are not being vc-ed, for that
> > > very reason.  They're not complex files, and I don't work heavily with
> > > them -- so why bother?
> >
> >
> > It really depends what you are doing, and what are yours requirements:
> > I would be very, very unhappy if some bit fungus eats those files, and
> > I had to re-create them from scratch (especially /etc/group).
>
> I don't keep any files with passwords in my repository for security reasons.
> In our environment, this means only ignoring shadow. group and passwd don't
> contain passwords (nor would they in most setups), so they should be safe to
> version.

> I'm pretty sure (though have not tested) that you can recreate
> shadow automatically from passwd should you have a catastrophic
> failure - of course you'll lose your passwords, but given it's a
> server I don't think there's more than 2 or 3 passwords in shadow
> (all other accounts are service accounts).

you'd also lose all password aging/expiration information, but that's
not as critical.

rday

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org