Describe cant_sftp here.
olbis use sftp. when sftp cannot connect,
1, check their ip address, and their user name
2, check /var/log/message and /var/log/secure
3, if their ip address or user name appear in /var/log/secure that mean its either wrong password, or wrong potocol, wrong potocol mean client version too old need to use newer client, wrong password will need to change password and try.
4, if their ip address not in /var/log/secure then switch off fail2ban then try connect again , if can connect , that mean they are ban by fail2ban, unban their ip using fail2ban-client.
5, check iptable -L and see if their ip was accepted.