How 2 Secure the repository?

[Dustin Cavanaugh]

Environment: cvs 1.11.1p running on unix. Clients are mostly wincvs1.13.7+ 
(in-house modifications to prevent password display on the screen), plink 
for ssh connection. Developers have valid login on unix server and are 
members of the cvs and users groups.

How do I protect the repository from developers modifying or deleting code 
directly without using cvs? Any protection scheme we've been able to think 
of either locks them out completely or has loop holes.