So if you want selective access (say no shell access for ssh you can do
something like this in the person's authorized key file:

command="/usr/bin/cvs server" ssh-dss publickeyblobhere someuser@somedomain