Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here is the situation. I have user access to a server and root access to the same server. I want to edit files for a user that I don't have password information for on the server. ssh'ing as root is disabled, so I typically ssh in as my user and then su to root. Then I cd to the user of interest's home directory and then su to the user of interest (provided the user of interest has shell access). If the user doesn't have shell access to the server I am forced to modify the files as root, which I loathe to do. So my first question is, how can I safely modify the user's files without being root if the user does not have shell access?

My second question involves transferring files to the user's account using a graphical SFTP program from my desktop. Since I don't have the user of interest's login information (and the user may not have shell access) I can't sftp directly into the user's account, nor can I sftp as root. So instead I use my graphical SFTP program to sftp into my user account's home directory on the server. Then I transfer the files via the SFTP program to my user account's home directory on the server, and then manually copy them as root from my user's home directory to the user of interest's home directory. Obviously this is inefficient and I long for a better solution. What is it?

Note: I realize that I can use the command line scp program to transfer the files directly to the user of interests home directory, but I want to use a graphical SFTP program.

share|improve this question
add comment

6 Answers 6

up vote 12 down vote accepted

Set up an rsa/dsa key pair on your own machine (ssh-keygen -t rsa), then append the public key to the user in question's ~/.ssh/authorized_keys file. If ~/.ssh doesn't exist - create it with 700 permissions, owned by the user.

Then you should be able to log in as that user using just the keys (no passwords)

share|improve this answer
    
I would bet that the user also needs to have shell access (i.e. a valid shell). You can get away with a locked password though. –  robcast Jul 23 '09 at 15:54
    
he's specifically asking about scp, although ssh should work as well –  Brent Jul 23 '09 at 16:19
add comment

http://winscp.net/eng/docs/faq_su

None of the protocols (SFTP, FTP and SCP) supported by WinSCP allow the user to be changed in the middle of file transfer session. You need to start the session with the correct user.

In some cases (with Unix/Linux server) you may be able to use sudo command straight after login to change a user, before file transfer session starts.

The SFTP and SCP protocols allow for this, but the actual method is platform dependent.

share|improve this answer
    
To clarify this, when a SFTC client connects it runs what sshd calls a "subsystem", namely sftp-server. There may be a way to configure sshd or your SFTP client to wrap this command in something like sudo -u user. –  Anthony Chivetta Sep 7 '10 at 8:08
add comment

su -c bash --login should give you a shell as that user regardless of their default (disabled) login shell. You can also put a line for yourself in their ~/.ssh/authorized_keys file, and that will allow you to login as them without using their password.

share|improve this answer
add comment

Upvoted unknown's WinSCP and Brent's SSH key solutions.

Just a note to say that you can use these two solutions together.

If you're unsure about generating the key, you can use PuTTyGen and WinSCP will be happy to use the format it generates.

share|improve this answer
add comment

su has a -s option to specify the shell to use if the user does not have shell access. For example:

su -s /bin/bash www-data
share|improve this answer
add comment

If I understand your questions, the simplest answer is to ignore SSH issues and treat the problem as a permissions issue instead. When users want to share access to files, they are put into the same group, and the file's permissions are set so that group has access.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.