I have currently setup my CentOS 6.6 VPS for clients who host websites on my server. They have FTP access using a virtual user (with vsftpd as the real user) that is chrooted to their www folder. Their emails are stored in the home folder of vmail, categorized per domain and (virtual) user.
In retrospect I see that this was quite clumsy. It would have been easier and probably better by using real users for all my clients, redirect their home folder inside /var/www and store their emails there too. Probably should prohibit PHP to leave the user's home directory too (not sure how though).
Is there a risk involved with my setup? Could an attacker that compromised user X easily compromise user Y? Would it be wise to switch to the proposed setup? This will take me days, I'm not sure if it's worth the effort...
I'm running Apache, MySQL, PHP, Postfix, Dovecot, VSFTP.