Match Group zone-admin
        ChrootDirectory %h
        ForceCommand internal-sftp
        AllowTcpForwarding no
        AllowStreamLocalForwarding no
        AllowAgentForwarding no
        AcceptEnv no
        X11Forwarding no
        PermitTunnel no
        PermitUserRC no
        PasswordAuthentication no