By Dave Cohen on

My CVS account has been reliable for a long time. Today, I can't access it. Tried changing my password, no luck.

When I try to do a checkout, diff, or anything that hits the cvs server, I get:

cvs checkout: authorization failed: server cvs.drupal.org rejected access to /cvs/drupal-contrib for user yogadex

What gives?

Comments

3cwebdev’s picture

3cwebdev commented

On Tuesday, November 3rd, it was discovered that scratchvm.drupal.org, used for testing Drupal infrastructure upgrades, was compromised by a brute force attack on a weak account password. The attacker was NOT able to achieve root access to the server. However, to ensure the continued security of user accounts, the Infrastructure Team has revoked passwords for Drupal CVS accounts and for Infrastructure Team members

extremely unlikely that CVS accounts could be compromised, passwords have been revoked as a precaution. To reset your CVS account password:
1) Log in to your user account at http://drupal.org/
2) Click on "My account" in the navigation block.
3) Click the "Edit" tab for your account.
4) Click the "CVS" sub-tab under "Edit".
5) Enter a new password, and click "Save".
6) Wait AT LEAST 30 MINUTES before attempting to use your CVS account. This
time is needed for the CVS server to synchronize your password.

Dave Cohen’s picture

Dave Cohen commented

Thanks. The waiting 30 minutes did the trick. Sorry now that I even asked.

b1tr0t’s picture

b1tr0t commented

I don't think you should be sorry you asked. The password change form for CVS says the following when you submit your password request: "Your CVS password has been updated successfully.". To me, this is quite a strong statement asserting that the password changed is active effective immediately. A better response would be: "Your password will be updated within the next 30 minutes." Definitely, the language there could be clarified and it would save users from searching and posting in the forums for this issue. :)

erykmynn’s picture

erykmynn commented

agreed, there is no indication of the wait time, and without it you're prone to just keep trying