I want to setup a small FTP server for personal use, and decided to use
vsftpd for that. I thought that I should enable
chroot_local_user, so users are chrooted to their home directory upon login. Although all users should not have read access outside their home directory, you are never safe from mistakes, right?
man vsftpd.conf says:
If set to YES, local users will be (by default) placed in a chroot() jail in
their home directory after login. Warning: This option has security
implications, especially if the users have upload permission, or shell
access. Only enable if you know what you are doing. Note that these
security implications are not vsftpd specific. They apply to all FTP daemons
which offer to put local users in chroot() jails.
What "security implications" do they mean? Do I have to remove the write permission of each user on it's home directory? Why is that? I can't imagine it's safer to not use chroot than to use it...