up vote 1 down vote favorite
share [g+] share [fb]

I set up a new Ubuntu server with one user to whom I granted full permissions by adding jsmith ALL=(ALL) ALL to the /etc/sudoers file. The idea being that I would be able to never log in as root and use jsmith all the time for the day-to-day administration of the server.

I want to use Coda to upload files to the server, logging in as jsmith rather than root.

Unfortunately, when I log in to the server under SFTP using root, I can upload files without issues. If I log in as jsmith, I can connect to the server and navigate all the way up to its root, but if I try to upload a file I get an error:

Screenshot

I suspect I've overlooked something in the configuration, but despite googling the issue I haven't been able to find a solution.

Any suggestions welcome.

link|improve this question
sudo doesn't have any effect when using sftp. Do you really want full filesystem access over sftp? – Paul Dec 9 '11 at 2:47
Yes, I do! I use that client to work on all my site files, and I want the convenience of being able to upload them to the server when ready without using the command line or having to log in as root. – Donald Jenkins Dec 9 '11 at 3:02
2  
Sure - but the entire file system? Why would you need to routinely upload files to / or /bin or /etc or /sbin? – Paul Dec 9 '11 at 3:38
No! Only up to and including www – Donald Jenkins Dec 10 '11 at 8:26
feedback

1 Answer

up vote 0 down vote accepted

It is generally a bad idea to use your daily account for administration – that's what 'root'/'sudo' are for. Giving yourself immediate full access to the entire file system is a huge security risk.

To use 'sudo' for SFTP in the OpenSSH server, you can edit the "Subsystem sftp" line in your sshd configuration. Write a script that checks if the user is privileged and executes the original 'sftp-server' with or without 'sudo' depending on the result, then point sshd to that script. Make sure you are allowed to execute said 'sftp-server' without requiring a 'sudo' password, otherwise it will not work at all.

link|improve this answer
1  
Thanks! I solved it by doing chown -R jsmith /var/www/ – Donald Jenkins Dec 10 '11 at 8:28
Good. That's a much better choice, given the intended usage. – grawity Dec 10 '11 at 15:24
Yup. Although i was wondering whether, for good measure, I should switch jsmith's default group (currently jsmith) to www-datatoo… Haven't quite worked out how group membership interacts with general permissions such as the one I just gave. – Donald Jenkins Dec 10 '11 at 19:36
Don't switch the default (primary) group. Instead you could add www-data to jsmith's secondary groups using gpasswd. // In Unix, if you are the owner of an object (file or directory), then your group memberships are not considered at all when checking access. – grawity Dec 10 '11 at 20:17
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.