0

I am using Sublime Text editor with its SFTP plugin to edit files (also root files) on my server. I thought there is some linux command or file that can be edited that would enable me to execute sudo at every file save, and even at every file open. At every file operation. Because I connect the editors SFTP client with a user from the wheel group that can be root in a passwordless way when executing sudo su.

And I have disabled root login to secure SSH. So I added "sudo" in the sftp subsystem path in my sshd_config file on the server, and it works - it can save with root privileges, it has the same result as if people would add "sudo" in the winSCP client settings at the sftp path. But I was told this is not a secure way to enable sudo at file save, because then every client that connects with the correct credentials will be root, not just my own client.

So I am looking for a more secure way to execute sudo at every file operation when I am using my SFTP client (which is a Sublime Text plugin), this plugin: codexns.io/products/sftp_for_sublime. Could you recommend a way to do this correctly?

14
  • Your command runs SFTP server as root, so ultimately every operation throughout the SFTP session will be done as root. Whether you use IP or FQDN is irrelevant in respect to the "sudo". Dec 5, 2021 at 18:51
  • Thanks @martin-prikryl! Originally I defined this path: sudo /usr/lib/openssh/sftp-server, in my sshd config file at the subsystem path. But I realized that means that all SFTP clients will have root access, if using the correct credentials. So it is much more secure to allow only my client to sudo, with the command: sftp -s "sudo /usr/lib/openssh/sftp-server" myhostname.fqdn. Can you confirm that this is the correct alternative? Thank you! Btw, how do I undo this command with an other command? Dec 6, 2021 at 11:16
  • But then anyone can do the same! (-s "sudo /usr/lib/openssh/sftp-server"). If you want only one specific user to be able to sudo, you have to do it on the server-side. But that's a different question than what you have asked. + "undo this command with an other command" What another command? Dec 6, 2021 at 11:53
  • @martin-prikryl after I execute this command sftp -s "sudo /usr/lib/openssh/sftp-server" myhostname.fqdn, how do I undo the changes? What file is this command modifying? Dec 6, 2021 at 12:08
  • So you don't recommend to set a sudo path like this sudo /usr/lib/openssh/sftp-server as the subsystem path in the sshd_config settings? Do you rather recommedn to execute sftp -s "sudo /usr/lib/openssh/sftp-server" myhostname.fqdn to achieve the same thing? I cannot change the path in the winSCP client because I don't use winSCP. How do you chnage the sftp path in the terminal in Ubuntu, if you don't use winSCP, into sudo /usr/lib/openssh/sftp-server? Since I don't use winSCP, I don't have a GUI way to change the path to use sudo. Dec 6, 2021 at 12:13

0

You must log in to answer this question.

Browse other questions tagged .