[Blind-sysadmins] Setting up a web server with FTP

Hi, I want to set up a web server with FTP on a Debian box. Idea is that users log in and get access to /var/www/host, but that is it. I have done this before but it wasn't the best option, and I need this to be as secure as possible (realising that the password for FTP connections go over plaintext). Any recipes/ideas that have worked in the past? Thanks. Andrew.