Ssh – Disable chmod in openssh-server

ProFTPd definitely supports an ssh-emulation mode for sftp use, and I'm fairly sure it will have the usual array of ftpd-normal config options for forcing ownerships, controlling uploads, and the like. I think it would definitely be worth a look for your use. I can't help with the ftpd upload-only config, but here's my config code for getting the SFTP support:

LoadModule mod_sftp.c

<VirtualHost 12.34.56.78>
  SFTPEngine            on
  Port                  443
  SFTPLog               /var/tmp/proftpd-sftp.log
  SFTPHostKey           /etc/ssh/ssh_host_rsa_key
  SFTPHostKey           /etc/ssh/ssh_host_dsa_key
  DefaultRoot           /home/testuser
<Limit LOGIN>
  AllowGroup            sftponly
  DenyAll
</Limit>
</VirtualHost>

The Port 443 was because we already had sshd running on port 22, plus we had to support a bunch of clients behind a variety of deeply-stupid firewalls, and port 443 is about the only destination that almost all sites allow unencumbered. There's some other stuff there about limiting access to one group of users and chrooting them all into the same place, which you probably won't need, but I include it because I can affirm that that config works as-is.

Starting with version 4.9 OpenSSH (not available in centos 5.x but ChrootDirectory feature was backported) has an internal-sftp subsystem:

Subsystem sftp internal-sftp

And then block other uses:

Match group sftponly
     ChrootDirectory /upload/%u
     X11Forwarding no
     AllowTcpForwarding no
     AllowAgentForwarding no
     ForceCommand internal-sftp

Add your users to the sftponly group. The chroot directory must be owned by root, and cannot be group-writeable, so create a subdirectory for each user, e.g. uploads or home/$username that's owned by the appropriate user (if you match their home directory, it will be the default working directory when connecting). I'd also set /bin/false as the user's shell.

As an example, users can then upload single files with:

sftp username@hostname <<< 'put filename.ext uploads/'

(scp will hopefully soon be modified to use sftp so this will become easier)