Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is the situation. I have user access to a server and root access to the same server. I want to edit files for a user that I don't have password information for on the server. ssh'ing as root is disabled, so I typically ssh in as my user and then su to root. Then I cd to the user of interest's home directory and then su to the user of interest (provided the user of interest has shell access). If the user doesn't have shell access to the server I am forced to modify the files as root, which I loathe to do. So my first question is, how can I safely modify the user's files without being root if the user does not have shell access?

My second question involves transferring files to the user's account using a graphical SFTP program from my desktop. Since I don't have the user of interest's login information (and the user may not have shell access) I can't sftp directly into the user's account, nor can I sftp as root. So instead I use my graphical SFTP program to sftp into my user account's home directory on the server. Then I transfer the files via the SFTP program to my user account's home directory on the server, and then manually copy them as root from my user's home directory to the user of interest's home directory. Obviously this is inefficient and I long for a better solution. What is it?

Note: I realize that I can use the command line scp program to transfer the files directly to the user of interests home directory, but I want to use a graphical SFTP program.

share|improve this question
up vote 12 down vote accepted

Set up an rsa/dsa key pair on your own machine (ssh-keygen -t rsa), then append the public key to the user in question's ~/.ssh/authorized_keys file. If ~/.ssh doesn't exist - create it with 700 permissions, owned by the user.

Then you should be able to log in as that user using just the keys (no passwords)

share|improve this answer
I would bet that the user also needs to have shell access (i.e. a valid shell). You can get away with a locked password though. – robcast Jul 23 '09 at 15:54
he's specifically asking about scp, although ssh should work as well – Brent Jul 23 '09 at 16:19

None of the protocols (SFTP, FTP and SCP) supported by WinSCP allow the user to be changed in the middle of file transfer session. You need to start the session with the correct user.

In some cases (with Unix/Linux server) you may be able to use sudo command straight after login to change a user, before file transfer session starts.

The SFTP and SCP protocols allow for this, but the actual method is platform dependent.

share|improve this answer
To clarify this, when a SFTC client connects it runs what sshd calls a "subsystem", namely sftp-server. There may be a way to configure sshd or your SFTP client to wrap this command in something like sudo -u user. – Anthony Chivetta Sep 7 '10 at 8:08

su -c bash --login should give you a shell as that user regardless of their default (disabled) login shell. You can also put a line for yourself in their ~/.ssh/authorized_keys file, and that will allow you to login as them without using their password.

share|improve this answer

Upvoted unknown's WinSCP and Brent's SSH key solutions.

Just a note to say that you can use these two solutions together.

If you're unsure about generating the key, you can use PuTTyGen and WinSCP will be happy to use the format it generates.

share|improve this answer

su has a -s option to specify the shell to use if the user does not have shell access. For example:

su -s /bin/bash www-data
share|improve this answer

If I understand your questions, the simplest answer is to ignore SSH issues and treat the problem as a permissions issue instead. When users want to share access to files, they are put into the same group, and the file's permissions are set so that group has access.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.