how to restrict a user in his home directory

they can't
at least on my server a user can not go into the directory from another user.
also they can not get into most directories outside /home
in the ones they can, they cannot download/view/edit sensitive files.
also they can not write to any files they do not have permission to.

the only 'risk' is a malicious user can see the usernames in /home and won't have to guess that part if he wants to attack. If you think you have malicious users or untrusted users, do not give them sh access.

on my server a domain owner can go into etc but NOT view proftpd.conf.
Per haps you need to review your security

also I have no idea what your mysql password is doing in that file, I don't see that in mine..

under webmin - servers - proftpd server - Files and Directories
Go to: Limit users to directories and set to: Home directory

not sure if that will do the trick for you but that is how it is set at my server.
Also securing your server is not a matter of clicking a button. I suggest to google and read a lot.

ah yes sftp sorry.
My users can dwell through the server, but they cant do anything nor read sensitive info and I only give sh to trusted users.

Trying to restrict them (chroot) seems to break security

I think you should look at other security measures on your server as to why your users can read sensitive files.

then you can use a script or use sed
per haps something like this through the cli

cd /tmp ; find -type f -name *.conf -maxdepth 4 | awk {'print "chmod -R 444 "$1'} |sh

put a file /tmp/whatever.conf in your /tmp with 777, then use that line to test.
if happy change cd /tmp in the cmd to whatever dir you like, so: cd /etc

<div class='quote'>But i think it is very dangerous that all users can see conf files everywhere on the server.</div>

The UNIX security model has been in use for more than 30 years, by millions of people. We think that's a pretty good indicator that it is not &quot;dangerous&quot;.

So, the obvious solution is to make files that contain sensitive information not readable by regular users. proftpd.conf does not need to be world-readable, and it isn't in the proftpd packages that we provide (but we only provide packages for a couple of platforms...mostly it comes from the OS repos, but I wouldn't expect them to be world-readable either).

If the data is truly &quot;sensitive&quot;, then it's worth it :-)

Restricting ProFTP or SSH to a home directory doesn't solve the problem -- a user could just as easily go into Virtualmin, and browse the server using the File Manager.

If you disable that, Joomla includes a file manager. Or they could just write their own code that searches for files and directories that they have permissions to view. Using a chroot in ProFTP or SSH can't prevent that, it only stops the case where the user is using FTP or SSH.

So the actual issue is not FTP, or SSH, it's that file permissions are set in a way that you deem to be insecure :-) The only way to solve that is to change the permissions.
-Eric