I want to setup a small FTP server for personal use, and decided to use
vsftpd for that. I thought that I should enable
chroot_local_user, so users are chrooted to their home directory upon login. Although all users should not have read access outside their home directory, you are never safe from mistakes, right?
man vsftpd.conf says:
chroot_local_user If set to YES, local users will be (by default) placed in a chroot() jail in their home directory after login. Warning: This option has security implications, especially if the users have upload permission, or shell access. Only enable if you know what you are doing. Note that these security implications are not vsftpd specific. They apply to all FTP daemons which offer to put local users in chroot() jails.
What "security implications" do they mean? Do I have to remove the write permission of each user on it's home directory? Why is that? I can't imagine it's safer to not use chroot than to use it...