Limit ftp directory when SFTP

SFTP uses file transfer via SSH, and thus falls under the same category as SSH in terms of "restrict directory visibility". Short answer: It can be done, but it requires lots of fiddling with jails and changeroot environments and specially crafted shells.

Large hosting companies usually do that, but Virtualmin is not really prepared for it. So you'd have to set this up manually, and it's recommended to try that only if you're very well-versed with the intricacies of your respective Linux distro. :)

Also note that, if this is a security consideration, there are other ways to browse the whole filesystem than SFTP. The webspace customer could e.g. simply upload a PHP-based file browser, and it's quite hard to prevent PHP from traversing the file system. At least not without severely restricting its functionality, possibly rendering other sites unusable.

Howdy,

In addition to what Locutus mentioned, there's some documentation on those issues here in the security FAQ:

https://www.virtualmin.com/documentation/security/faq

Or you could use FTPeS (mod_tls):

http://www.virtualmin.com/node/29262

: )