Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I regularly have to deploy stuff via scp. The problem is that the user on the remote machine (e.g. tomcat) does not match the user i am logging in with (e.g. mylogin). And almost always I cannot login directly with the remote user (disabled from the admin)

Assume the following: I want to deploy a file into tomcats' webapps folder but can do this only via 'sudo -U tomcat' on the remote machine before.

At the moment I am doing sth. like this:

scp file.war
ssh 'sudo -U tomcat cp /home/mylogin/tmp/file.war /tomcat/webapps/'

Is there a better solution without the temporary folder? I mean, is it possible with only one copying with a sudo "in-between"? Can this be done with portforwarding?

This question is related to this

share|improve this question
up vote 0 down vote accepted

Have your admin set up a user for SFTP-only access (this will not enable you to use SSH by "pushing a new config", whatever that means), and install your key for you, to a user in the same Unix group as tomcat, and have the tomcat user's directory made g+w. Then you would do something like

$ scp myfile upload@remotehost:~tomcat/

This is what the Unix group system is for, and this is what everyone did before the boneheads at Red Hat decided for some unknown reason that each user should have their own group.

share|improve this answer

Add your public key to the authorized_keys file of the tomcat user. This will allow you to ssh as tomcat:

scp file.war
share|improve this answer
Hi Cakemox, I have a similar scenario, in which I am downloading via scp from a Linux DB Server, I have added the SSH Keys to the appropriate directories on the host db box, but now anyone from that specific client, can SSH as root to that machine. Is it possible that I can allow root scp access no password but disallow any ssh root logins without password. - this is a internal virtual machine but still disabling root without password apart from scp would be desirable - thanks. – rihatum Nov 3 '10 at 12:13
Hi rihatum. It is possible to set up scp-only access or sftp-only access, but you run the risk of someone re-enabling ssh access by simply pushing new configs to re-allow ssh access. It would be safer to scp as a normal user, but set the permissions to allow that user to write to the files and/or directories as needed. I'm not sure root scp-only access can be guaranteed, maybe someone else has some ideas. I wouldn't recommend it, though. – Cakemox Nov 3 '10 at 12:22
in my case this is not possible because tomcat (and similar root) cannot login into the remote machine - as I said this is disabled from the admin - even if I would add my key! – Karussell Nov 3 '10 at 12:31
maybe there is a hack with port forwarding or pipeing? – Karussell Nov 3 '10 at 12:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.