It's quite possible, and there are a number of ways to do this. There are kludges and elegant solutions. It all depends on the fine details of what you want to do and how much time you want to invest.
If you have some remote-only users that you want to restrict to scp/sftp, you might want to look at scponly and this set of instructions on how to make it work (assumes Debian).
You could also try rssh, which is another shell replacement to do the same thing.
You should also make a group for these restricted users and (of course) add the users to the group. Then, add something like this to your
sshd_config file (often found in
Match Group sftp-only
#ChrootDirectory /somewhere/%u # Optional chroot jail
#AllowTcpForwarding no # Disable TCP forwarding
#X11Forwarding no # Disable X11 forwarding
#Umask 700 # Set the umask
This will disable/force things like TCP forwarding for these users. You obviously need to remove the
# for the ones you need. Check the
sshd_config(5) manpage for more details on this.
Of the kludges, the simplest is to change the user's shell to
nologin (on Debian,
/usr/sbin/nologin respectively). A slightly more complex kludge is to put a check in
/etc/profile for the user or the user's group and log them out with a ‘not allowed to log in’ message. If you like to hedge your bets (I do), you can do that as well. Just remember that it's not sufficient on its own.
If you have the Snail Book, chapter 8 (freely available as a sample) also has some recipes.