[tinus_hn]

It uses pam so you can configure it however you want or even write your own module.

It’s dangerous though, be sure to check these users don’t get shell access or the ability to create network pipes.

[LinuxBender]

also symlinks and hardlinks. You can restrict this in the internal-sftp subsystem assuming you force sftp.