ssh lets you restrict the command a user is allowed to run in the authorized_keys file. mostly unknown feature but very handy. i have found this useful for allowing users to do just one or two things (eg. rsync a particular dir).
see http://www.hackinglinuxexposed.com/articles/20030109.html ~gb
