Customer has SFTP access to all directories on server

[vecdeal]

I've got a clean WHM installation on a clean VPS (provided by Memset). I've added a couple of customer accounts, eg. mysite.com. When I SFTP to mysite.com, using the customer's username/password, I land in /home/mysite, and as expected cannot see /home/anyothersites.

However, from /home/mysite, I can navigate upwards to /home, and then to /, and then on to all the other folders on the VPS - and can read and write files anywhere. Surely I shouldn't be allowed to do this...? Is this normal for a default installation? How do I stop it?

Thanks.

[Infopro]

and can read and write files anywhere

You may be able to see files but you should not have permission to write to them.