1

I set up a new Ubuntu server with one user to whom I granted full permissions by adding jsmith ALL=(ALL) ALL to the /etc/sudoers file. The idea being that I would be able to never log in as root and use jsmith all the time for the day-to-day administration of the server.

I want to use Coda to upload files to the server, logging in as jsmith rather than root.

Unfortunately, when I log in to the server under SFTP using root, I can upload files without issues. If I log in as jsmith, I can connect to the server and navigate all the way up to its root, but if I try to upload a file I get an error:

Screenshot

I suspect I've overlooked something in the configuration, but despite googling the issue I haven't been able to find a solution.

Any suggestions welcome.

Improve this question
4
  • sudo doesn't have any effect when using sftp. Do you really want full filesystem access over sftp?
    – Paul
    Dec 9, 2011 at 2:47
  • Yes, I do! I use that client to work on all my site files, and I want the convenience of being able to upload them to the server when ready without using the command line or having to log in as root.
    – Donald Jenkins
    Dec 9, 2011 at 3:02
  • 2
    Sure - but the entire file system? Why would you need to routinely upload files to / or /bin or /etc or /sbin?
    – Paul
    Dec 9, 2011 at 3:38
  • No! Only up to and including www
    – Donald Jenkins
    Dec 10, 2011 at 8:26

1 Answer 1

Reset to default
0

It is generally a bad idea to use your daily account for administration – that's what 'root'/'sudo' are for. Giving yourself immediate full access to the entire file system is a huge security risk.

To use 'sudo' for SFTP in the OpenSSH server, you can edit the "Subsystem sftp" line in your sshd configuration. Write a script that checks if the user is privileged and executes the original 'sftp-server' with or without 'sudo' depending on the result, then point sshd to that script. Make sure you are allowed to execute said 'sftp-server' without requiring a 'sudo' password, otherwise it will not work at all.

Improve this answer
4
  • 1
    Thanks! I solved it by doing chown -R jsmith /var/www/
    – Donald Jenkins
    Dec 10, 2011 at 8:28
  • Good. That's a much better choice, given the intended usage.
    – u1686_grawity
    Dec 10, 2011 at 15:24
  • Yup. Although i was wondering whether, for good measure, I should switch jsmith's default group (currently jsmith) to www-datatoo… Haven't quite worked out how group membership interacts with general permissions such as the one I just gave.
    – Donald Jenkins
    Dec 10, 2011 at 19:36
  • Don't switch the default (primary) group. Instead you could add www-data to jsmith's secondary groups using gpasswd. // In Unix, if you are the owner of an object (file or directory), then your group memberships are not considered at all when checking access.
    – u1686_grawity
    Dec 10, 2011 at 20:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .