In the template https://github.com/dev-sec/chef-ssh-hardening/blob/master/templates/default/opensshd.conf.erb if you look for allowtcpforwarding, if you enable sftp, it would be declared twice with the hardcoded value overriding the one you set