CVS - Secure way to deploy content to web server

I am new to this list but we have run into an issue for deploying content to
our web servers.  Right now we send a tar ball to the servers and have them
explode and hope all of the servers are in sync.  What we would like to do
is to use a CVS client on the web servers and pull from our repository to
each of the web servers.  Our issue is that in order to do this we would
have to open a port to get inside our firewall.  
 
So my question is this, how do content management applications get around
this problem?
 
Any idea's or suggestions would be greatly appreciated.
 
Thanks