Content taken from https://www.digitalocean.com/community/tutorials/how-to-enable-sftp-without-shell-access-on-ubuntu-16-04
Add a test user account to 'own' the uploads directory
sudo adduser testuser
Create the uploads directory
sudo mkdir -p /var/sftp/uploads
sudo chown root:root /var/sftp
sudo chmod 755 /var/sftp
sudo chown testuser:testuser /var/sftp/uploads
Now that the directory structure is in place, we can configure the SSH server itself.
Restrict acsess
sudo nano /etc/ssh/sshd_config
Add the following to the bottom of the file:
Match User testuser
ForceCommand internal-sftp
PasswordAuthentication yes
ChrootDirectory /var/sftp
PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
To apply the configuration changes, restart the service.
sudo systemctl restart sshd
Verify the Configuration
# should fail - only sftp connections are allowed
ssh testuser@localhost
Verify the user can access SFTP
sftp testuser@localhost