[QUOTE BY= mkalien] or allow SSH but not let user’s out of their home directory and disallow executing scripts/files? Even so, they could still run all sorts of terminal commands that could tie up the processor and other resources.[/QUOTE]

Chroot ssh isn’t that hard to set up actually (however, I am still on 10.3.9 so I can’t say with certainty this will work on a Tiger box too). The weird thing I ran into was that something besides xinetd seems to need to restart for it to notice your new paths. Basically, I followed this tip over at MacOSXHints and got it set up. (Follow the instructions of the first guy and remember that if you want to restrict Users to just their their own folder, you’re going to need to put all the goodies they will need in each of their folders for chroot to work right. The example given in the hint just restricts them to the Users folder, meaning they can wander around in other user’s folders too.

One more important tip: After each system update, be sure to verify that Apple didn’t overwrite your custom /usr/libexec/sshd-keygen-wrapper. Because if they did, everyone has top-level directory access to the box again!

Argh, one more note: The winning property to edit the path in was NFSHomeDirectory. That’s where you want to add the /./ to the path to turn on chrooting.