[Note: This only applies to OpenSSH 4.8 and above.]
Short tutorial for creating sftp-only accounts for untrusted users. The user will be chrooted to their home directory, and will not be able to write to the root directory. You will need to make subdirectories for the user so they can write files.
1. Create a group for untrusted users:
# groupadd untrusted
2. Add an untrusted user (or two, or three):
# useradd -c 'my test user' -d / -g untrusted -s /bin/false testuser
3. Use a random password generator and assign the user a password
# passwd testuser
4. Create a home directory for the untrusted user (don't chown it, needs to be root.root)
# mkdir /home/testuser
5. Create subdirectories for the user. I'm creating a www root directory, and a directory to store files
# mkdir /home/testuser/{public_html,files}
# chown testuser.untrusted /home/testuser/*
6. Edit /etc/ssh/sshd_config to instruct sshd to use the internal sftp backend
Subsystem sftp internal-sftp
7. Append the following match block to /etc/ssh/sshd_config
Match group untrusted
ChrootDirectory /home/%u
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp