access denied to cvs.drupal.org

Dave Cohen - November 9, 2009 - 19:02

My CVS account has been reliable for a long time. Today, I can't access it. Tried changing my password, no luck.

When I try to do a checkout, diff, or anything that hits the cvs server, I get:

cvs checkout: authorization failed: server cvs.drupal.org rejected access to /cvs/drupal-contrib for user yogadex

What gives?

From Maintainers-news bulletin

setfree - November 9, 2009 - 19:17

On Tuesday, November 3rd, it was discovered that scratchvm.drupal.org, used for testing Drupal infrastructure upgrades, was compromised by a brute force attack on a weak account password. The attacker was NOT able to achieve root access to the server. However, to ensure the continued security of user accounts, the Infrastructure Team has revoked passwords for Drupal CVS accounts and for Infrastructure Team members

extremely unlikely that CVS accounts could be compromised, passwords have been revoked as a precaution. To reset your CVS account password:
1) Log in to your user account at http://drupal.org/
2) Click on "My account" in the navigation block.
3) Click the "Edit" tab for your account.
4) Click the "CVS" sub-tab under "Edit".
5) Enter a new password, and click "Save".
6) Wait AT LEAST 30 MINUTES before attempting to use your CVS account. This
time is needed for the CVS server to synchronize your password.

Thanks. The waiting 30

Dave Cohen - November 10, 2009 - 01:19

Thanks. The waiting 30 minutes did the trick. Sorry now that I even asked.

Ran into the same thing and ...

b1tr0t - November 12, 2009 - 23:44

I don't think you should be sorry you asked. The password change form for CVS says the following when you submit your password request: "Your CVS password has been updated successfully.". To me, this is quite a strong statement asserting that the password changed is active effective immediately. A better response would be: "Your password will be updated within the next 30 minutes." Definitely, the language there could be clarified and it would save users from searching and posting in the forums for this issue. :)

agreed, there is no

erykmynn - November 18, 2009 - 00:28

agreed, there is no indication of the wait time, and without it you're prone to just keep trying

 
 

Drupal is a registered trademark of Dries Buytaert.