How do I create a user with read only access over SSH to a limited subtree of folders?

Solution 1:

If you really want to restrict them down as much as possible, I suggest looking at a chrooted ssh install. That way even if they did manage to break out their tree they wont be able to trawl around the underlying system.

The Debian guys have a guide available on the subject.

Solution 2:

rssh does exactly that. From pizzashack.org:

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. It now also includes support for rdist, rsync, and cvs. For example, if you have a server which you only want to allow users to copy files off of via scp, without providing shell access, you can use rssh to do that. For a list of platforms on which rssh is known to work, see the Platform Support Page.