I've always been fond of the rbash shell... symbolic link bash to rbash, then set their shell to /bin/rbash.... pretty cool.