Как запретить пользователю ftp заходить на сервер по ssh?
в /etc/ssh/sshd_config прописать 
DenyUsers или DenyGroups
вырезка из man sshd_config
DenyUsers
 This keyword can be followed by a list of user name patterns, separated by spaces.  Login is disallowed for user names that match one of the patterns.  Only user names are valid; a numerical user ID is not recognized.  By default, login is allowed for all users.  If the pattern takes the form USER@HOST then USER and HOST are separately checked, restricting logins to particular users from particular hosts.  The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.
usermod -s /sbin/nologin ftp
usermod -s /bin/date ftp
Идея в том, чтобы дать шелл, который ничего не делает ;)