Firewall Wizards: ssh setup for scp?

[ark () mpak convey ru (-= ArkanoiD =-)]

nuqneH,

I am going to make some files on firewall system available
for scp (script mode - so no passwords) to admin workstation.
What is the best way to allow scp operation _only_ and nothing else
(i want to ensure that there will be no danger for firewall if admin
workstation is compromised)? Any advices?

-- 
                                       _     _  _  _  _      _  _
   Must be a visit from the dead..     _| o |_ | | _|| |   / _||_|   |_ |_ |_
   CU in Hell ..........  Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|