Legacy Source Control: CVS under xinetd
We have a team that uses legacy source control: cvs. We run cvs pserver under xinetd (config file below).
Audit Flag
A security audit raised a flag: "make sure the cvs server does not run under root".
Question:
Can I safely lock down the 'cvs pserver' by replacing "user=root" with "user=cvs" ? Any harmful side effects or 'gotchas' ?
Note: User "cvs" owns all files in the 'cvs root' directory "/var/cvs/cvs"
I ask because I've searched around through all the decade-old documentation and all examples have 'user=root' and none suggest changing the "user=" parameter to increase security.
Update: I tried it. It worked. No problems.
Thanks
Example: cvspserver config file
# Begin /etc/xinetd.d/cvspserver
service cvspserver
{
port = 2401
socket_type = stream
protocol = tcp
wait = no
user = root
passenv = PATH
server = /usr/bin/cvs
server_args = -f --allow-root=/var/cvs/cvs pserver
}
# End /etc/xinetd.d/cvspserver