> Sadly the OpenSSH solution is over the top awkward when it comes to setting up chrooted access, but it works.

With OpenSSH it's pretty easy to setup users in a chroot, with no shell access. The hard part is if you want logging (to audit what they do), then you need to create a log device in their chroot, which adds complication, and you need OpenSSH 5.2+.

sshd_config:

  Subsystem       sftp    internal-sftp -l VERBOSE
  Match Group sftponly
          ChrootDirectory %h
          ForceCommand internal-sftp -f AUTH -l VERBOSE

Make user1 only be able to use SFTP:

  groupadd sftponly; usermod -a -G sftponly user1; usermod -s /sbin/nologin user1
  

If you actually want the "-l VERBOSE" logging to work you need to create ~user1/dev, then modify rsyslog.conf with:

  $AddUnixListenSocket /path/to/user1/home/dev/log