How can I limit a new user to being able to download or at most upload and download files to only one subdomain if they use an FTP program. Once I give them a user name and password the new user, if knowledgeable, seems to be able to snoop around quite a bit.
One option would be to place that particular sub-domain under the control of the user in question. This will place the web-directory for the sub-domain in that user’s home directory. When that user logs in via FTP, they will only have access to the web-directory for that sub-domain, not any other domains and/or sub-domains you may have under other users.
Also, make sure you do not give them shell access.