Im using CVS_RSH=ssh. Is the whole session encrypted or just the authorization?
When you connect through SSH, you encrypt _all_ the data. This is this way because then, the only way to access the repository is the SSH protocol, and it is used for authorization and for transferring the files as well. You can test this by closing all the ports on that a computer listens except the corresponding to the SSH connections (TCP 22). You can do that with an intermediate firewall or simply closing the port in the CVS server computer. The try to work with the CVS. You will see than you can still work.
