You don't even need an explicit tunnel as long as you're running SSH on both ends. Just set your CVS_RSH environment variable to ssh and you're set.

xoxo,
Andy
--
<megaphone> Throw down the gun and tiara and come out of the float! </megaphone>