On the server side, you can use the Match User or Match Group directive to set up custom configurations for certain users or groups. To see how it's done, look at the example at the very bottom of the /etc/ssh/sshd_config file. There, you'll see the following:

# Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server

Of course, this has no effect since it's commented out, but that's okay. Here's what we see for user anoncvs:

• He can't do X11 forwarding.
• He can't do TCP forwarding.
• He won't have the use of a command Terminal.
• As soon as he logs in, he'll be starting the Concurrent Versioning Service (CVS) server. By not having use of the Terminal, anoncvs can start the CVS server, but can't do anything else.

You can set up different configurations for as many users as you need to. Anything that you put in the custom configurations will override the global settings. To set up a custom configuration for a group, just replace Match User with Match Group, and supply a group name instead of a user name.