For LOAD (Linux Open Administration Days), I had to provide shell access to a few people in order to maintain the Drupal site. Since this is a multisite Drupal installation, simply providing shell access would be a huge security issue.
Here's how I secured it as much as possible:
Step 1: create an ssh chroot jail
cd /usr/local/sbin wget http://www.fuschlberger.net/programs/ssh-scp-sftp-chroot-jail/make_chroo... chmod 700 /usr/local/sbin/make_chroot_jail.sh
I adapted the script to include vi. Next I created a user.