SFTP: Enable/disable per user level

You can enable and disable SFTP for a certain login class user. By default, SFTP is not allowed for users added to the system defined classes read-only, operator and unauthorized and is only allowed to the system defined class super-user if SFTP is enabled globally. For a user assigned to a user defined class, by default SFTP requests are allowed if set system services ssh sftp-server is configured. You can now deny SFTP requests for a user assigned to a user defined class by using the no-sftp-server configuration statement. To disable SFTP for a certain login class, use set no-sftp-server at the [edit system login class ] hierarchy level.