I usually log in to a SSH server (where I'm an unprivileged user) by using my public keys. I also use authentication by a password when I use the server as a [git-annex](http://git-annex.branchable.com "git-annex")
 repository.

What I want to do is to allow only `git-annex`-related commands to be executed when sshd is autheticated with a password. `git-annex` comes with a wrapper that's a counterpart of `git-shell` for `git`. I know I could use `authorized_keys` to do this in other situations, but not in this particular case.

How can I do this? The server is Debian wheezy with OpenSSH\_6.0p1 Debian-4+deb7u3.