Why can an ftp user read all server files?

Question

CentOS

created an ftp user via ispmanager,
specified /home/daw as the home directory
and why this user can climb up the directory... all the way to the server's root folder...
and what should be done to prevent this...?
What should be the rights to the subfolders of the root folder of the server?

Answer 1

You need to make a chroot for users.
For example for ProFTPd:
DocumentRoot ~