Note: This was a failed attempt to set up pserver. I subsequently succeeded and blogged about it here.

I want to give anyone read-only access to the AudioMan CVS repository and it seems like the pserver protocol is the way to do it. Now, pserver is an insecure protocol so it needs to be used in a secure environment. Two secure options are a chroot jail or ssh.

ssh is the secure shell that I used for secure CVS access for developers. The difference is that pserver allows anonymous access while the developer access through ssh I set up requires a Linux user for each CVS committer. I'm not sure if Eclipse - the IDE of choice for this project - supports pserver through ssh.

A chroot jail limits the damage that a pserver client can do by limiting the file access of the internet services daemon xinetd. Apparently the old daemon inetd wasn't secure and was usually running as root. Exploiting this daemon would give you full access to the machine. Yeah, not too good. So what a chroot jail does is make the directory it uses look like root: /. The rest of the filesystem is hidden and inaccessible to the daemon.

So here's how I set up secure anonymous pserver access. I decided to use Juan M. Casillas' Jail Chroot Project to set up the chroot jail.

1. Downloaded Jail to my home directory.
2. Installed Jail. As root I unzipped the downloaded Jail archive and went into the src directory. I did make and then make install, which installed Jail in the default directory, /usr/local/.
3. Add a new user cvsuser that the pserver will use:
useradd -d /usr/local/cvsroot/ -s /usr/local/bin/jail cvsuser.

NOTE: I'm stalled here. I tried the next steps on CVS in Jail and ended up in the rhubarb. I think Jail is too specialized and doesn't do what I want to do ... it's adding a whole bunch of directories to my cvsroot. I don't think I'm on the right track. I'm posting this for people's comments and I'll update it.

If I can't get pserver access working by the end of this week, I'm just going to release the code as part of the 0.1.1 release. It's holding things up too much.

References
1. xinetd FAQ
2. CVS Pserver and Xinetd
3. CVS in Jail
4. Introduction to Jail