# HG changeset patch
# User Paul Crowley <paul@lshift.net>
# Date 1235343572 0
# Node ID 964ac53280cb926e3c14ed9f5649a4407799eb84
# Parent  909f3801ee44f8a56507e094825ede28223b424a
Security of mercurial-server

diff -r 909f3801ee44 -r 964ac53280cb README
--- a/README	Sun Feb 22 12:56:00 2009 +0000
+++ b/README	Sun Feb 22 22:59:32 2009 +0000
@@ -116,6 +116,14 @@
 way - these users will now be able to control hgadmin and create new
 repositories just as you can.
 
+Once you're working with "hgadmin", it can be convenient to remove all the keys
+in "/etc/mercurial-server/keys" and all the entries in
+"/etc/mercurial-server/access.conf" and use hgadmin to control everything. If
+you find yourself locked out, you can get back in again by restoring some of the
+entries you removed from these files - remember,
+"/etc/mercurial-server/access.conf" takes precedence over the "access.conf" in
+"hgadmin".
+
 ACCESS.CONF
 
 Out of the box, there are just two kinds of users: the ones with keys in
@@ -225,15 +233,27 @@
 committed, which uses the rules file to determine whether to allow the
 changeset.
 
-LOCKED OUT?
+SECURITY OF MERCURIAL-SERVER
+
+mercurial-server relies entirely on sshd to grant access to remote users. As a
+result, it runs no daemons, installs no setuid programs, and no part of it runs
+as root except the install process: all programs run as the user hg. And any
+attack on mercurial-server can only be started if the Bad Guys already have a
+public key in ~hg/.ssh/authorized_keys, otherwise sshd will bar the way. No
+matter what command the user tries to run on the remote system via ssh,
+mercurial-server is run. 
 
-Once you're working with "hgadmin", it can be convenient to remove all the keys
-in "/etc/mercurial-server/keys" and all the entries in
-"/etc/mercurial-server/access.conf" and use hgadmin to control everything. If
-you find yourself locked out, you can get back in again by restoring some of the
-entries you removed from these files - remember,
-"/etc/mercurial-server/access.conf" takes precedence over the "access.conf" in
-"hgadmin".
+It parses the command line the user asked for, and interprets and runs the
+corresponding hg operation itself if access is allowed, so users can only read
+and add to history within repositories; they cannot run any other hg command. In
+addition, every push and pull is logged with a datestamp, changeset ID and the
+key that performed the operation.
+
+However, while the first paragraph holds no matter what bugs mercurial-server
+contains, the second depends on the relevant code being correct; though the
+entire codebase is currently only about twice as long as this README,
+mercurial-server is a fairly new program and may harbour bugs. Backups are
+essential!
 
 THANKS