Quoting Ron Roskens (roskens@elfin.net):
> 
> Your missing the "CVS_RSH" environment variable.
> 
> sh:
> export CVS_RSH=ssh
> 
> csh:
> setenv CVS_RSH ssh
> 
> and then run the cvs command.

Is there any reason not to just have CVS (and rsync and rdist)
just use ssh by default?

I mitigate it a lot by removing rsh and making it a link to
ssh, but should we "presume" that rsh is useful for ANYTHING?
Sure, let it be there for override (CVS_RSH=rsh), but lets
move on.

Between clear passwords and session highjacking, the r* commands
are ready to die.  They were Joy's hack in 4.1 (and part of 4.2),
they're still a hack.