Index: doc/cvs.texinfo
===================================================================
RCS file: /cvs/cvs/doc/cvs.texinfo,v
retrieving revision 1.1.1.2
retrieving revision 1.3
diff -u -r1.1.1.2 -r1.3
--- doc/cvs.texinfo 13 Apr 2003 20:34:16 -0000 1.1.1.2
+++ doc/cvs.texinfo 16 Apr 2003 16:25:45 -0000 1.3
@@ -2489,13 +2489,41 @@
the username and password using the operating system's
user-lookup routines (this "fallback" behavior can be
disabled by setting @code{SystemAuth=no} in the
-@sc{cvs} @file{config} file, @pxref{config}). Be
-aware, however, that falling back to system
+@sc{cvs} @file{config} file, @pxref{config}).
+
+The default fallback behaviour is to look in
+@file{/etc/passwd} for this system password but if your
+system has PAM - Pluggable Authentication Modules - then
+cvs will use that instead. This means that with a
+global configuration file usually @file{/etc/pam.conf}
+or possibly @file{/etc/pam.d/cvs}
+you can tell cvs to use LDAP or normal UNIX passwd
+authentication or many other possibilities - see your
+PAM documentation for details. CVS needs an "auth"
+and "account" module in the PAM configuration file.
+Using PAM gives the system administrator much more
+flexibility in how cvs users are authenticated but
+no more security than other methods, see below.
+
+Be aware, however, that falling back to system
authentication might be a security risk: @sc{cvs}
operations would then be authenticated with that user's
regular login password, and the password flies across
the network in plaintext. See @ref{Password
authentication security} for more on this.
+This may be more of a problem with PAM authentication
+because it is likely that the source of the system
+password is some central authentication service like
+LDAP which is also used to authenticate other services.
+On the other hand PAM makes it very easy to change
+your password regularly - this is impossible to do
+for a user authenticated via cvs' private password file
+without total access to the @file{CVSROOT/passwd} file
+, i.e. the user needs all rights to the repository to
+allow password change which in my experience means
+the password never gets changed, see below. Users are
+much more willing to change their password regularly
+if they only have to remember one.
Right now, the only way to put a password in the
@sc{cvs} @file{passwd} file is to paste it there from