I just installed Pure-FTPd (pure-ftpd-1.0.30-1.el6.x86_64
) on my CentOS 6.5 server.
I'm using "virtual users", so the FTP users are disconnected from the system accounts.
Nevertheless, the pure-ftpd daemon itself is running as root, and all the uploaded files are root-owned.
On the manual I read that all the clients are chrooted to their home dir, but I'm a bit uneasy with the uploaded file being uploaded+owned by root. Should I change the pure-ftpd users or am I worrying for nothing?
A few clarifications:
1) I'm trying to do an assessment on the security of this configuration: if I find out that this default is safe, I'm more than happy to keep it as it is and don't mess with it
2) Buffer overflows are one of the aspect I worry about