Drush only SSH access using a dedicated key.

authorized_key

command="/etc/drush/drush-shell" ssh-rsa AAAA...== drush

drush-shell

#!/bin/bash
# /etc/drush/drush-shell
# Restrict SSH access to Drush command only.
if [ -z "$SSH_ORIGINAL_COMMAND" ] ; then
    export SSH_LOGIN=
    echo "Error: Login to this account is not permitted!"
else
  echo $SSH_ORIGINAL_COMMAND | grep --quiet '^drush'
  if [ $? -eq 0 ] ; then
    exec drush ${SSH_ORIGINAL_COMMAND:5:-5} 2>&1 
  else
    echo "Error: Only Drush is allowed!"
  fi
fi