Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Legacy Source Control: CVS under xinetd

We have a team that uses legacy source control: cvs. We run cvs pserver under xinetd (config file below).

Audit Flag

A security audit raised a flag: "make sure the cvs server does not run under root".

Question:

Can I safely lock down the 'cvs pserver' by replacing "user=root" with "user=cvs" ? Any harmful side effects or 'gotchas' ?

Note: User "cvs" owns all files in the 'cvs root' directory "/var/cvs/cvs"

I ask because I've searched around through all the decade-old documentation and all examples have 'user=root' and none suggest changing the "user=" parameter to increase security.

Update: I tried it. It worked. No problems.

Thanks

Example: cvspserver config file

# Begin /etc/xinetd.d/cvspserver

     service cvspserver
     {
          port        = 2401
          socket_type = stream
          protocol    = tcp
          wait        = no
          user        = root
          passenv     = PATH
          server      = /usr/bin/cvs
          server_args = -f --allow-root=/var/cvs/cvs   pserver
     }

# End /etc/xinetd.d/cvspserver
share|improve this question

1 Answer 1

up vote 1 down vote accepted

You should absolutely follow their advice. It is extremely good advice.

Generally, when doing this, you will need to ensure that the daemon has enough rights to do what it does. In this specific case, that most likely just means the ownership it already has. My suggestion would be to back up your repository and just go ahead and make the change.

The way this works is that xinetd (often running as root) will drop privileges and then execute the /usr/bin/cvs with stdin and stdout directed toward the socket which xinetd manages. There really isn't anything to it. CVS is simple enough and shouldn't require any permissions beyond being able to manipulate the files under its root.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.