1. Goal
Provide limited file access to remote users without a full interactive shell.
2. Files and components involved
/etc/ssh/sshd_config
/srv/sftp
/etc/passwd
/etc/group3. Operational flow
create sftpusers group
create /srv/sftp/user structure
add Match Group block in sshd_config
restart sshd4. Operational verification
sshd -t
sftp user@localhost
tail -n 50 /var/log/secure5. Practical notes
Apply these changes during a maintenance window and keep a backup of the original files for a quick rollback.
Tightening a policy without an alternative access path is the fastest way to lock out legitimate users as well.
Quick checklist
[ ] Backup or copy of the existing configuration completed
[ ] Files and commands updated as expected
[ ] Local test completed successfully
[ ] Logs or final output verified
[ ] Rollback procedure documented