(In 2023) this is possible with vanilla openSSH.
The according request is setstat
.
So if you specify the following in your /etc/ssh/sshd_config
:
Match User mysftpuser
ChrootDirectory /home/mysftpuser/chroot #or else they see their .ssh dir
ForceCommand internal-sftp -P lsetstat,setstat,fsetstat #deny chmod
it will do just that.
I added lsetstat
and fsetstat
as well, as these do the same for links and file handles.
You can also add -u xxxx
to specify a given umask.
See /usr/lib/openssh/sftp-server -Q requests
for a list of requests you can blacklist. Or probably (even better) just whitelist only those needed.
You need to reload sshd
and re-login with your SFTP client for changes to take effect.
I think the accepted answer should be changed to this one, as the accepted one is incorrect (now).