CVS doesn't use "locking" per se, but you can access the underlying RCS locking through the "cvs admin" function. RTFM about cvs admin -l and -L. If users are accessing the repository remotely via pserver, then the simple, brute force way is to turn off cvspserver in inetd.conf.
