Making SSH restricted user in Ubuntu VPS

Hello,

I have an Ubuntu VPS instance that I can SSH tunneling to it. I can use root or a new user that I create for that purpose. But what if I want to create a separate user for my friend to use. For sure I wouldn't hand him root or any normal user account so that he could mess my VPS up (intentionally or not).

I want to make that user restricted to only SSH tunneling service without any other privileges. It's better if he just connect and cannot run any command and just log off when finish using it. What's the best or easiest way to achieve this?

Thanks!

http://ift.tt/1dvHQ0Z