You have to be really careful though because the default is to give users shell access. If you think you can limit that by forcing users to run some command you'll run into trouble because the user can specify environment variables.

The user also by default gets allowed to set up tunneling which would allow anonymous users to use your network address.