> > What I'm really looking for is a way to have the return connection "given
> > the nod" by A, by virtue of the fact that it is started by a ssh session
> > from A?
>
> You could do ssh agent forwarding from "A" to "C" with a key which
> grants access to the subsystem in question..
>

Bill and David,

Many thanks for your help with this.

After some fiddling around, I think I'm going rely mainly on agent
forwarding now that I've understood it some more.  (I didn't quite
understand how it worked until last night.)  I'm going to create a
separate "sshcvs" user locally that can only exec "cvs server" when the
key is used.

Cheers,

David.