This requirement is interesting. My client is using Internet Explorer to ftp://
[username]@NNN.NNN.NNN.NNN (ip address). When permitted full access, it's a no-brainer and works just as expected.
When there's a restricted shell (bash -r), it doesn't even complete the login. How do I allow him to ftp up and down, but that's IT? Or, is there some other "almost as restricted" way to do this that I haven't seen anyone yet discuss?