I modified /etc/ssh/sshd_config with these lines to support an sftp user group that isn't able to SSH.
Subsystem sftp internal-sftp -l VERBOSE
Match Group sftpusers
X11Forwarding no
AllowTcpForwarding no
ChrootDirectory %h
ForceCommand internal-sftp
I create a user in the sftpusers group, with ssh capabilities restricted like so:
useradd -g sftpusers -s /sbin/nologin <username>
The problem is, even if I use the following command to give recursive permissions to all users and groups in their home folder, when they create a new file, they immediately lose access because the default file permissions are not what I recursively set the file structure to:
chmod -R 777 /home/<username>/
I've tried giving the user ownership of the file structure, but that makes it so the user can no longer sftp (I believe because of the ChrootDirectory option, making it so their home directory and all sub components must be owned by root). I'd really like a solution that allows a user to only be able to sftp (no ssh) while having no access to the majority of files in their home directory, unless specifically given access or created by them.