[rdiff-backup-users] Allowing only rdiff-backup across a connection, how to set up?

[Chris G]

If I want to allow *only* rdiff backup to use an ssh link between two
machines what's the best way of setting it up?

What I want to be able to do is set up a [relatively] insecure
passwordless ssh link, i.e. a private key at one end with no
passphrase, but make it fairly secure by only allowing rdiff-backup to
run across that connection.

If I simply put "ForceCommand rdiff-backup" at the ssh 'server' end
will it do what I want or do I need to put the exact rdiff-backup
remote end command there?  .... or is there a better/easier way to
achieve what I want to do?

-- 
Chris Green