Is this secure, for setting up account FTP access to random users?

Question

I was looking for a somewhat less strenuous way to add users every few days (that wish to be granted ftp access with their own folder) on my site. I had found this guide on the softlayer KB for vsftp (I run on Ubuntu Server)

Create a FTP user group. eg: ftpaccounts
#/usr/sbin/groupadd ftpaccounts

Add a new user to this group, and set the default path of that user to /home/user/.
#/usr/sbin/adduser -g ftpaccounts -d /home/user/ testuser

Set a password for the newley created user.
#passwd testuser

Set ownership of /home/user to the testuser and ftpaccounts.
#chown testuser:ftpaccounts /home/user

Give Read/Write access to testuser and all members in ftpaccounts
#chmod 775 /home/user

Edit /etc/vsftpd/vsftpd.conf file and make sure 'local_enable=YES' is uncommented.

Restart the vsftpd service.
#/etc/init.d/vsftpd restart 

Now only using this guide, such as setting them up with their own chowned /home/ folder, will they only be able to log in/modify /home/user and log in via FTP to user@mysite.com, or is this a security risk?

Virtual users seened a little hard for me, so I am looking at this.

Answer 1

consider using only sftp for your users. ftp transfers passwords and content unencrypted, nice little attack vector for 'evildoers' :)

Answer 2

As with akira's suggestion and a bit of googling, I had found a simple way to make an SFTP-only account. This would require this entry in /etc/passwd:

(assuming the path is my sftp server)

sftponly:x:9042:8080:sftp-only:/home/sftponly:/usr/local/libexec/sftp-server

After passwd'ing it, I add this to /etc/shells

echo "/usr/local/libexec/sftp-server" >> /etc/shells

And it should be tied to /home/sftponly. I have yet to try this, so if someone stumbles upon this and sees something downright wrong, feel free to point it out. I will test what I can.