Instead of using...
I want to use
How would I do this? It would be good if users can't access
/var and such. I only need this for data transfers.
Create a user whose home directory is
Make it as restrictive as possible.
Then you'll need to create that wrapper for scp. Something as simple as the following will work, but you'll want to add more security conscious checks and tests before using it in production.
This is just an example of what's possible. In this case, the full scp command is captured in the environment variable
Users can probably still access sticky public directories, like /tmp, but they'll have no access to roam around /var, or /home.
and they may be able to pull files off your server, but you could wrap all this up with