How do I change user after login (e.g. su root)?
None of the protocols (SFTP, FTP and SCP) supported by WinSCP allow the user to be changed in the middle of file transfer session. You need to start the session with the correct user.
Direct Login
Easiest way is to allow direct login with the user account you need, if it is not allowed already. For accounts such as root , the direct login is typically disabled by default for security reasons. So when enabling it, have security in mind.
Particularly with SSH , you may want to keep password authentication (the most vulnerable one) disabled and use e.g. public key authentication instead. With OpenSSH server, you can do that by setting sshd_config keyword PermitRootLogin to without-password .1
Use sudo on Login
In some cases (with Unix/Linux server) you may be able to use sudo command straight after login to change a user, before file transfer session starts.
FTP protocol does not allow this.
The SFTP and SCP protocols allow for this, but the actual method is platform dependent.
- With SFTP protocol, you can use SFTP server option on SFTP page of Advanced Site Settings dialog to execute SFTP binary under a different user. With OpenSSH server, you can specify:
Note that SFTP server binary may be located elsewhere2 (e.g. in /usr/lib/sftp-server , /usr/lib/openssh/sftp-server or /usr/libexec/openssh/sftp-server ).
- With SCP protocol, you can specify the following command as custom shell on the SCP/Shell page of Advanced Site Settings dialog:
However you will not be able to provide a password for su (see remote command execution limitations). So you may be able to do the above only if you are allowed to do sudo su without being prompted with password. See sudo documentation to learn how to do that. For example you can add following line to sudoers file ( /etc/sudoers ):
The above line is very permissive, it allows user yourusername connected from anywhere (the first ALL ) to run any command (the second ALL ) as a root without being asked for password. So you should restrict it as much as possible.
For example with OpenSSH you may restrict it only to SFTP session by:
Note that as WinSCP cannot implement terminal emulation, you need to have sudoers option requiretty turned off (which is default).
Получение root прав при работе в WinSCP
Поскольку хорошим тоном считается отключать доступ под root’ом в любой UNIX системе, то любители поработать с файлами через WinSCP могут испытать разочарование из-за отсутствия возможности проводить какие-либо операции с директориями и файлами, к которым у них нет доступа. Однако решение есть.
Даем права root при работе через WinSCP
Для начала нужно найти файл sftp-server:
В ответ терминал выдаст примерно что-то следующее:
Запоминаем путь /usr/lib/sftp-server (вместо него может быть другой, зависит от дистрибутива), и переходим к редактированию конфига /etc/sudoers:
В самом конце файла, с новой строки пишем:
Где ВАШЛОГИН — это логин пользователя, который должен работать с рут правами, а /usr/lib/sftp-server — это путь, который мы узнали выше с помощью команды whereis.
Если нужно добавить больше, чем одного пользователя, то просто с новой строки повторяем написаное выше.
Теперь осталось дело за малым — отконфигурировать WinSCP. Открываем свойства соеденения, в пункте «Протокол передачи» обязательно выставляем SFTP.
Далее нажимаем кнопку «Еще», и там уже, в панели слева, выбираем пункт «Среда — SFTP». В самой верхней строчке под названием «Сервер SFTP» пишем следующее:
Сохраняем и пользуемся WinSCP с полным рут доступом ко всем файлам в системе.
How to connect as root using WINSCP
In my previous post I noted that I had not succeeded in in connecting to a linux machine as root using WINSCP when using the bitnami virtual machine.
My development implementation works, so I have progressed to using the cloud hosted bitnami instance. This comes with public key access rather than password access. This actually make it easier to connect.
- Download your private key, if using bitnami use the cloud console, if using AWS use the AWS console. Store it with no spaces in the file name.
- Optionally put it into your Pageant keystore
- Verify that you can connect using PuTTY
Connect to an Ubuntu server as a root using WinSCP
Using WinSCP is one of the most popular ways to transfer files to a remote Linux server. In this post, I will explain how to connect to an Ubuntu server as a root using WinSCP. First, it is important to note that the root user is not directly accessible with a login operation in Ubuntu and other Linux distributions. Using an unprivileged user as an intermediate login is the first step.
Background
Windows customers can download WinSCP for free and use it as an SFTP client, FTP client, WebDAV client, S3 client, or SCP client. Its primary function is to transfer files between local and remote computers. Additionally, WinSCP supports scripting and basic file management.
If you are using WinSCP to access the root folder, create a new folder (directory), or simply transfer files, you might see one of the following errors if you don’t access it using the root account.
This error happens due to the current user doesn’t have the root rights and permissions will be denied.
Keep in mind, that for accounts such as root, the direct login is typically disabled by default for security reasons. So when enabling it, have security in mind. And also, you can’t change to a root account in WinSCP when you are already logged into a session, as you can do in the Linux shell using su.
Note: This solution also works for AWS EC2 instances.
Connect to an Ubuntu server as a root using WinSCP
Before continuing, we need to make sure about some obvious things in our Ubuntu server:
- You have installed the SSH server.
- You have created a root account.
Option 1
This is the most common option that you’ll see around…
@Your Ubuntu Server
- Log into your Ubuntu server, and using the terminal (Shell), become root via su or sudo.
- Run the command visudo to update the /etc/sudoers.tmp file. Then, configure this file to allow other users to become root without a password. Add the following line:
- Replace “user” with the user you want to grant access to the root account. Your regular unprivileged username.
@Local Machine WinSCP
- In Win SCP, open a new session. Change the File Protocol option from SFTP (default) to SCP. Input your server credentials, host name, user name, and password. Then hit Advanced…
- In advanced. Go to Environment / SCP/Shell. Under Shell, type:
sudo su —
- Leave the rest as default. Click OK.
- On the main login window, click Login.
- You should be able to access the root folder now. Or copy and create directories.
Option 2
With option 1, you might get another error:
Error skipping startup message. Your shell is probably incompatible with the application (BASH is recommended)
This could be your case, or you just can’t manage to get option 1 to provide root access to your server. In any case, try this option 2.
@Your Ubuntu Serve
- Run the command visudo again. This time, add the following line at the end of the file:
- Replace “user” with the user you want to grant access to the root account. Your regular unprivileged username.
@Local Machine WinSCP
- In WinSCP, open a new session. In File Protocol, leave SFTP as default. Input your server credentials, host name, user name, and password. Click Advanced…
- In advanced. Go to Environment / SFTP. Under Shell, type:
sudo /usr/lib/openssh/sftp-server
- Leave the rest as default. Click OK.
- On the main login window, click Login.
- This time, you might not able to log in automatically, but after inputting the root account password, you’d be good to go.
- Now, you should be able to access the root folder. Or copy and create directories.
There are many workarounds to connect to an Ubuntu server as a root, using WinSCP. Here I am sharing two general options based on my experience, but consider that these configurations can vary depending on your scenario, Linux version, and more options.
Note: Take a look at a similar issue using VMware and WinSCP. Unable to Access the VCSA 6.7 via WinSCP