[cvsnt] Recommended setup

[MJ]

Dear Tony, Arthur and anyone else :-)

I would like to know, what kind of setup you would recommend. We're running 
CVSNT on a Windows2003 SP1 server (in an AD domain). We have three groups of 
users:
  1) Users on our LAN
  2) Remote users using cached domain-logins
  3) Remote users logged on to other domains
All users use the :sspi protocol. Remote users connect to our cvs-server 
through a SSH tunnel between an old SSH.com server (running on the same 
server as CVS) and a variety of SSH-clients (putty in many versions, old 
SSH.com).
We would like to get rid of some or all of the software to establish 
tunnels, and would like to know:
  1) Can the :sspi protocol encrypt the files as they as transmitted? Does 
it do so by default? Can it be configured to do so for remote clients only?
  2) I know that cvsnt has some kind of SSH client built in to support the 
:ssh protocol. Does it have the server-side as well, or do you need a SSH 
server to use :ssh? Will remote users be impersonated on the server when 
running :ssh (we use ACLs a lot to limit access to parts of the repository)?
  3) What protocols, setup etc. would you recommend?

Currently we use an old version (2.5.03 build 2151) on the server and most 
remote users use 2.0.51d, but we would like to move to newer version (build 
2382 ?? - or what would you recommend) on the server as well as the clients.

Best regards

Morten Jøhnk