Publishing papers occasionally. I have a patch to add directory-based user access control to CVS . In other words, you can limit access for users on a directory basis. It's not perfect, but it's a lot better than nothing. With the newest patches and SSL, the server becomes a relatively secure program with almost full remote administration capability.
Users can handle directory permissions and change their passwords through the interface.
Administrators can add and remove users. I've got some thoughts on that. It's called sserver, and is still somewhat experimental, but it offers substantually improved security over standard pserver. The tar file for this is here . The diff file is here , but you MUST have automake-1.4a or later to use it.