The default service settings are applied to all users who do not belong to the admin group or the SFTP group. Deny all services from them on the Basic and SFTP tabs.

Figure 5.16. All services denied from default groups

Figure 5.17. SFTP service denied from default groups

Notice that denying the terminal service, denies also X11 and agent forwarding and shell commands for the specified group (unless some commands are explicitly allowed).