On Mon, 2007-06-11 at 15:06 -0400, Dan Stoner wrote:
> I want to allow users to upload files using sftp and scp in a web 
> hosting environment.
> 
> I don't want to give full shell access.

You replace their shell with a script that checks to make sure the
command they're running is either scp or sftp, and exits otherwise.

The guts of ours:

[[ $# -gt 0 ]] && shift
set -- $1
case "$1" in
  scp) exec ${OPENSSH}/$* ;;
  ${OPENSSH}/sftp-server) exec $* ;;
esac

Others are addressing whether or not ssh is the right tool; assuming it
is, that's what we do.