I need to allow a user to connect to a Mac OS X 10.5.7 Leopard box, and restrict them to log in only by SFTP, to a chrooted jail.
I've successfully configured OpenSSH using internal-sftp so the user can use sftp but not get a raw ssh session. To do that I created a user and added them to a group, then used a Match Group entry in sshd_config
However, the user is also showing up on the user selection screen at the console, and can log in interactively there.
I've modified the users UID to be 499, but that trick doesn't work on Leopard any more - and doesn't stop a user from typing the credentials in manually anyway.
Changing the user's shell doesn't seem to help either - it just prevents sftp from working.
Any ideas on how I can lock this user out of an interactive login?