[cvsnt] cvsnt + openssh + tortoisecvs: can get a full checkout without a valid cvs username + password?

[Rogier Eijkelhof]

Hi, I've got something strange with CvsNT + OpenSSH and TortoiseCVS. I have 
setup the cvs server with cvsnt 2.0.58 and OpenSSH 3.8p1-1. For CVS I have 
created a windows user named "CvsNtUser", and for SSH a user "OpenSshUser", 
both with Guest rights (that is: member of Guests group) and different 
passwords.

The passwd file in my CvsRepositories' CVSROOT dir contains only one line: 
JohnDoe:*******zIb4wc:CvsNtUser (meaning there is only 1 cvs user named 
"JohnDoe" which uses CvsNtUser's system rights, his password is different 
from the two windows users' passwords). The cvs server is running on a 
non-standard port.

Similarly, I have added a passwd entry for in the OpenSSH\etc dir 
OpenSshUser by doing "mkpasswd -l -u OpenSshUser >> ..\etc\passwd"

I can login with SSH (using PuTTy 0.55) with the OpenSshUser account. I can 
also get a CVS checkout (not using SSH) with TortoiseCVS 1.8.0 using the 
:pserver: protocol, server IP and CVS port, and username JohnDoe. When 
doing the checkout I have to fill in JohnDoe's password. So far so good.

But now the strange thing: when trying to checkout through SSH, I select 
the :ext: protocol, for server I fill in the saved PuTTy session (which 
contain the server's IP and SSH port), leave the port field empty (in 
tortoise), and username OpenSshUser. TortoiseCVS asks for the password for 
OpenSshUser at cvsserver, I fill in the password (that is, the windows user 
password for "OpenSshUser"), and I get all the sources as well!

What troubles me: how can I get the sources without specifying the cvs user 
name (JohnDoe) and password, nor the port on which cvsnt is running??

I also tried changing & committing a file, and the history says the author 
is OpenSshUser, which isn't a known CVS user at all. Am I missing something 
or is this not the way things are meant to work?

Thanks, Rogier.