cvs commit -m "Added an external LockDir" CVSROOT/config
cvs release -d CVSROOT
You can now make your cvsroot readonly:
cd /usr/local/share
find cvsroot -type d | xargs chmod 500
find cvsroot -type f | xargs chmod 400