[cvsnt] ACL questions

[Mark Johnson]

I am currently running cvsnt 2.5.01 (Travis) Build 1976  on Linux
(RHEL 3.0).  I have configured my linux server to authenticate from
our windows network, and am using sspi protocol for cvs access.  We
use win 2k/XP/2003 with WinCvs and TortoiseCVS.  I have  not added any
users to  any CVSROOT files, and currently everyone who authenticates
on the server has full cvs access.  I now want to implement
restrictions: different access rights for different repositories,
modules, CVSROOT, etc.

Can I use cvs chacl, or does this require adding users to a CVSROOT file?
What permissions do I need to run this command.
When I run "cvs lsacl" as anyone but root, I get the following:

 > cvs -d :sspi:slcp3esgcvs01:/testrepo lsacl 
 > cvs server: User 'mjohnso2' cannot modify permissions for /cvs/testrepo

Is this possibly because I have not yet set any acl permissions?

Any help/insight is appreciated....including a good rtfm reference if
it applies.

Thanks,
Mark