CVS users

I’ve setup CVS, have a project going, successfully added modules, updated, and committed.

I’m a bit confused about allowing others access to CVS modules though. From what I understand, any dreamhost user (with shell access?) can access it if they know the cvs server and the repository folder. Do they need to be on the same server as I am though?

Also I tested this with another user account (on the same server) and got an error that it couldn’t write to the history file. Do I need to edit permissions for this? I’m concerned about the security of the CVSROOT.

Lastly I’m a little unclear on where the the log file of comments during commitments is kept. the history file just seemed to track what was done, but not include comments.

I’ve used CVS and SVN before, but I haven’t actually setup a repository until now. Some friends and I will be working on something and I just want to make sure I have it setup right before we begin.