Another trick I especially like is to use the command="" syntax inside of an authorized_keys file to allow a user to execute certain commands via ssh, especially handy for git-shell.