Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For security I only allow a dummy user to log in via SSH on my CentOS 5.8 server, for this I added:

AllowUsers dummyaccount

When accessing my server I then login with the dummy and use su - to gain root privileges, this works perfectly well.

Now I've set up sftp using:

Subsystem sftp /usr/libexec/openssh/sftp-server

When I make an ssh tunnel with my ssh client and connect to it with FileZilla I can nicely login with my dummy account and I end up in its root.

However I'd now like to either gain root permissions with my dummy account when on sftp so I can completely manage the file system with it OR I'd like to allow root login on sftp but not on ssh, so in other words I'd login in ssh with the dummy and use su - to gain root permissions like described above but when I'd make a ssh tunnel I'd be able to login with my root over sftp.

I've heard of a way to only allow sftp access for a user by changing their shell to the sftp-server, but that's clearly not an option for root since changing its shell would break the system for all I know. Making a different user with that configuration works, but then they'll have just as limited access to the file system over sftp as the dummy.

What would you suggest?

share|improve this question

Require key based authentication. Set the PermitRootLogin without-password option. Setup a key that has a force command of internal-sftp. Or update your sshd_config with a match section to force sftp.

Match user root
    ForceCommand internal-sftp  # force SFTP
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.