Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I set up a new Ubuntu server with one user to whom I granted full permissions by adding jsmith ALL=(ALL) ALL to the /etc/sudoers file. The idea being that I would be able to never log in as root and use jsmith all the time for the day-to-day administration of the server.

I want to use Coda to upload files to the server, logging in as jsmith rather than root.

Unfortunately, when I log in to the server under SFTP using root, I can upload files without issues. If I log in as jsmith, I can connect to the server and navigate all the way up to its root, but if I try to upload a file I get an error:

Screenshot

I suspect I've overlooked something in the configuration, but despite googling the issue I haven't been able to find a solution.

Any suggestions welcome.

share|improve this question
    
sudo doesn't have any effect when using sftp. Do you really want full filesystem access over sftp? –  Paul Dec 9 '11 at 2:47
    
Yes, I do! I use that client to work on all my site files, and I want the convenience of being able to upload them to the server when ready without using the command line or having to log in as root. –  Donald Jenkins Dec 9 '11 at 3:02
2  
Sure - but the entire file system? Why would you need to routinely upload files to / or /bin or /etc or /sbin? –  Paul Dec 9 '11 at 3:38
    
No! Only up to and including www –  Donald Jenkins Dec 10 '11 at 8:26

1 Answer 1

up vote 0 down vote accepted

It is generally a bad idea to use your daily account for administration – that's what 'root'/'sudo' are for. Giving yourself immediate full access to the entire file system is a huge security risk.


To use 'sudo' for SFTP in the OpenSSH server, you can edit the "Subsystem sftp" line in your sshd configuration. Write a script that checks if the user is privileged and executes the original 'sftp-server' with or without 'sudo' depending on the result, then point sshd to that script. Make sure you are allowed to execute said 'sftp-server' without requiring a 'sudo' password, otherwise it will not work at all.

share|improve this answer
1  
Thanks! I solved it by doing chown -R jsmith /var/www/ –  Donald Jenkins Dec 10 '11 at 8:28
    
Good. That's a much better choice, given the intended usage. –  grawity Dec 10 '11 at 15:24
    
Yup. Although i was wondering whether, for good measure, I should switch jsmith's default group (currently jsmith) to www-datatoo… Haven't quite worked out how group membership interacts with general permissions such as the one I just gave. –  Donald Jenkins Dec 10 '11 at 19:36
    
Don't switch the default (primary) group. Instead you could add www-data to jsmith's secondary groups using gpasswd. // In Unix, if you are the owner of an object (file or directory), then your group memberships are not considered at all when checking access. –  grawity Dec 10 '11 at 20:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.