I just setup my second customer. 

I was testing their ftp access and noticed that it is possible to access the directory tree above their home directory! 

For example, when they ftp in, they are at /var/www/vhosts/their.site.com/. From here they have access to their httpdocs directory as expected. Unbelievably, they are able to cd .. up one level to /var/www/vhosts. From there, they are free to move around to other customer sites. How can that be? 

What do I need to do to clamp this down so that my customers can't see other customer's directories? This is very bad and shouldn't be the default behavior.

Thanks
George

Okay, support got me fixed up. For future reference, this is what they did. If anyone can explain to me the concept of "chrooted", I would really appreciate it.

They added "DefaultRoot ~" into /etc/proftpd.conf.

Now, I assume they had to restart the ftp server once they made the change to the configuration file but they didn't say that they did beyond telling me about the above change.

George