"ssh user at server /bin/sh" vs "no-pty" option.

[rz1a at nwgsm.ru]

Hello List,

 Do I get it right that I *MUST* chroot a user first and make
 /bin/rssh his shell in the /etc/passwd to effectively restrict him?
 There should be no /bin/ksh (or bash) in his jail?
 If I do not jail him - no matter what is his passwd shell - he will
 be able to issue "ssh user at server /bin/sh" still, right?

-- 
Best regards,
 Anthony                   mailto:rz1a at nwgsm.ru