Re: allow only sftp?

> > Since subsystems do: $SHELL -c $SUBSYSTEM
>
> If this does what it sounds like, seems a pretty dumb decision.

Many sites set up users with specific shells that read global and per-user configuration files to set up their environment correctly, such as to set an appropriate umask, create process limits, or add things to your path. While you can do this in PAM as well, not every machine has PAM built in, and many many administrators don't know how to configure these things using PAM, so you'd be depriving them of this option.

--
Brian Hatch                  I have no cognitive
   Systems and                powers.  It's amazing
   Security Engineer          that I'm respirating.
http://www.ifokr.org/bri/     --bree

Every message PGP signed