Mailing-List: contact dev-help@continuum.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@continuum.apache.org
Received-SPF: pass (athena.apache.org: domain of wsmoak@gmail.com designates
 209.85.161.43 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:from:date:message-id:subject:to:content-type;
        b=Pc3xVGUu79TCX/Ri/N2XDJLij8qy+4NN4AlEq3O+rwNyvPKwvbfRdasmlP1D82LKuE
         RQG+hkBRUIDuWkC6Tr38I9DDg4bkyim/BnkMeO8ytzCQ088xQFPM7W0GCEThw4Q2XMby
         SzaqO+SNtP1pF/Xozx8wy+A3tIrDDlHAAb+dw=
MIME-Version: 1.0
From: Wendy Smoak <wsmoak@gmail.com>
Date: Tue, 28 Dec 2010 16:39:19 -0500
Message-ID: <AANLkTim41-P=Ugpiu4=de_NKAB5jzW01OnAjju6avhhS@mail.gmail.com>
Subject: Build agent security
To: dev@continuum.apache.org
Content-Type: text/plain; charset=ISO-8859-1

This bit of CONTINUUM-2599 caught my eye:

"Current workaround to get Build Agent's installation is by directly
using the Build Agent Web Service."

I was under the impression that while the build agent would accept
XML-RPC requests from anyone, it would only send responses back to the
master defined in its config file. (See CONTINUUM-2044)

Did something change and you are now able to connect directly to the
agent and do things/get information without an authorization check?
(There is no authentication/authorization on the build agent.
(right?))

In addition, a comment on 2044 reminded me that CONTINUUM-2545 added
unsecured webdav access to the working copy.

Any thoughts on whether build agents should be better secured, and if so how?

* http://jira.codehaus.org/browse/CONTINUUM-2599
* http://jira.codehaus.org/browse/CONTINUUM-2044
* http://jira.codehaus.org/browse/CONTINUUM-2545

-- 
Wendy