Is it safe to give clients access to sFTP

Question

Information Security

Hello. I am not strong in system administration (please do not kick hard).

There is a server (centos 6.5 + vesta control panel - standard ftp-server).
For each client, a separate user is made, in it and, accordingly, their sites. Access (chrootdirectory) is limited for these users to the /home directory or the user's folder -% h (in ssh_config).

Is it smart/safe to give the client access to sftp, respectively, and access to ssh is obtained?
Or is it better to return the FTP client and give access to it only? They only need access to files (maybe they will).

Answer 1

Please note that there are many ways to get out of these chroots if you give a shell to such users.
If the shell is /bin/false, then everything should be fine.

Answer 2

there is a post for you in the topic, for example habrahabr.ru/post/89473/

Answer 3

It is not safe, in general, to give access to the console, it is fraught with incomprehensible people, an example from life, I came to one of the providers of the big three (more precisely, a daughter). , I noticed that rman stopped working, I start checking, and oh my God, the oracle user account was hacked, moreover, they compiled and launched the software from him, I start asking those who installed it, it turned out that the user was given access via ssh + the password was not secure.
For me, the fewer people have access to the console, the calmer.