I have a Linux server, where when I connect by PuTTY, I first need to log in using a non-root account (let's say user1), and then issue the command su root or su - root to log in to the root account. I cannot log in directly to the root account as such direct access is blocked for security reasons.  I would like to know how such a setup can be achieved in WinSCP, a GUI file manager for Unix/Linux servers. I have tried tunnelling to the same IP address but this does not work as I believe this attempts a "direct" login to the root account through the tunnel connection established using user1 account. Setting Shell to sudo su - also does not work.  How do I get WinSCP to emulate the su root or su - root indirect login as it can be done in PuTTY?
83132
I'm using WinSCP to access Unix computers. How can I change user after I have logged into a Unix server using WinSCP?  E.g. I have personal account in Unix computer A. I can log into this computer using PuTTY and then change user to root user  $sudo /usr/bin/su - rootuser   How can I do the same thing using WinSCP? I don't know the password for rootuser.
49700
It's very weird that after switching to zsh from bash, I can't access root.  I normally use 'su' to login as root after I login as a normal user (username is normalusername) with less privileges. And it was always nice. But after switching root shell from bash to zsh, when I try to login via su, I got:  normalusername@(none):~$ su Password: (enter the correct password) Cannot execute zsh: No such file or directory   When I access root directly via ssh from my Mac, I got:  localhost:~ myname$ ssh -lroot 106.186.120.20 root@106.186.120.20's password: (enter the correct/incorrect password) Permission denied, please try again.   No matter whether I entered the correct password, it comes again and again.  So I intentionally entered a wrong password with "su" from a normal user, I got:  normalusername@(none):~$ su Password: (entered a wrong password and pressed enter) (pressed enter) su: Authentication failure   After entering the incorrect password I didn't see anything, I typed enter twice and then got the su: Authentication failure result.  I tried for many times and the conclusion is:   If I enter the correct password, it will tell me that "Cannot execute zsh: No such file or directory" If I enter the incorrect password, it will not showing up anything until I hit enter for 2-6 times.   It seems to be an indication that I didn't just forget the "correct password". But how can I access root anyway?  The entry in /etc/passwd is  root:x:0:0:root:/root:zsh
45191
I have a ubuntu server running some LXD containers - none of these have public IP's, but are exposed to the web by a reverse proxy for HTTP.   These containers belong to different individuals and I would like to be able to allow them to login to the container via SSH. I don't want to allow users to be able to try passwords on containers other than their own one, And I don't want users to have to configure the SSH tunnel / gateway themselves.   So I'm wonderig if there's a way that I can set up an SSH gateway such that, based on the users key or username, the proxying is automated for them through the gateway.  This old article -  - seems to imply that something like this is possible: "The SSH gateway works by forcing a ssh to another host as a particular username, based on the ssh key."   However I can't find any other reading about it ... Is this something that can be done?
93332
I regularly ssh to a centos 5 box. Somehow they keys are mapped so that control+d will log me out of my current shell. If I am sudo'ed to another use it puts me back to the previous user. If I am not sudo'ed it just disconnects me. How can I keep this from happening? I regularly use control+d to cancel out of the python interpreter and sometimes I accidentally press it more than once.
101113
This is a idea for a security. Our employees shall have access to some commands on a linux server but not all. They shall e.g. have the possibility to access a log file (less logfile) or start different commands (shutdown.sh / run.sh).  Background information:  All employees access the server with the same user name: Our product runs with "normal" user permissions, no "installation" is needed. Just unzip it in your user dir and run it. We manage several servers where our application is "installed". On every machine there is a user johndoe. Our employees sometimes need access to the application on command line to access and check log files or to restart the application by hand. Only some people shall have full command line access.  We are using ppk authentication on the server.  It would be great if employee1 can only access the logfile and employee2 can also do X etc...  Solution: As a solution I'll use the command option as stated in the accepted answer. I'll make my own little shell script that will be the only file that can be executed for some employees. The script will offer several commands that can be executed, but no others. I'll use the following parameters in authorized_keys from as stated :  command="/bin/myscript.sh",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-dss AAAAB3....o9M9qz4xqGCqGXoJw= user@host   This is enough security for us. Thanks, community!
9702
I am trying to follow what I assume is best practices of using sudo instead of root account.    I am running a simple concat file operation such as:  sudo echo 'clock_hctosys="YES"' &gt;&gt; /etc/conf.d/hwclock   This fails as to the right of the ">>" it is running as the normal user.  Adding extra sudos also fails (expected behaviour since piping to the sudo command and not to the file).  Example is just that but it has been verified and tested under the root account.
95185
A sample script can be as below:  #!/bin/bash sudo su ls /root   When using ./test.sh as the normal user, instead run ls as super user and exit, it switches to root; and when I logout, it executes ls /root as the normal user.  Can anybody tell me about the mechanism about it?
93918
I love Linux and everything she stands for; however, unfortunately I grew up with Windows. Thusly so I have learned very bad practices (such as NT Authority will protect me). I have several Linux VPS's for personal and educational uses and I manage all of them from the command line. Through the management of these servers I have learned very painful lessons of the power of the Root user. Such as:   rm -d -R /* chown www-user:www-user -R /* Etc.    I've only removed my root directory twice, but just last week I changed the permission of the whole drive - effectively locking the Root out.   Now I know that I should never be logged in as Root, but most of the time I have to deal with files that only the Root owns so I sudo and run the command.   So my question is, is there a way to prompt the user (who is root, or sudo'ed) when a potentially hazardous command is executed, so the user may rethink their decision? Possibly through scripts in Bash, or a different sudo wrapper.   Or (I ask this hopefully, and very simplified) is there a way to set up permissions where instead of a two tier user system (Root user, regular user) there is a three tier system like in Windows (NT Authority, Administrator, other User). Basically is there a way to keep the ability of System administration, but restrict access to some system files.
80163
If you use sudo su - or sudo -s you will get the full root certification  "likewise a root user ".  Is this user an official user or is it from canonical?  ~$ sudo su - [sudo] password for username:  root@lp:~# id uid=0(root) gid=0(root) groups=0(root) root@lp:~# pwd /root root@lp:~#
68200
For security purposes my company wants me to not allow anyone to be able to log into our Ubuntu server as root remotely over SSH. We still want the root account to exist, we just do not want it to be able to be logged into remotely. How would I accomplish this?  Thank you very much in advance for your time.
118380
I am trying to understand how user permissions work in Linux. The kernel boots and starts init as root, right? Init then runs startup scripts and runs getty (agetty), again as root. Agetty just reads user name and runs login, still as root, I think. Nothing interesting yet. But what does login do? I wasn't able to find anything better than "it attempts to log in". Suppose login finds that password matches (and we trying to log in as usual user), how does it change user id? I thought that there should be system call for that but I wasn't able to find it (maybe I'm just blind?)    Also, about su. su has the 'setuid' bit set so when we run it, it always runs as root. But when we tell it to log in as usual user, it again needs to change user id. Do I understand correctly that the same "magic" happens in su and login when they need to change user? If so, why have two different programs? Is there any additional sorts of serious business happening when running login?
98973
I have a remote host, previously I can ssh into it with root and password  ssh root@remote_host   or I ssh into it first using a regular user account  ssh esolve@remote_host   and then su root and input password  but today, in both ways, my password is always incorrect, like  [esolve@local esolve]$  ssh root@remote_host root@remote_host's password:  Permission denied, please try again.   or   [esolve@remote_host ~]$ su root Password:  su: incorrect password   related information:   I can use this password to log in with root if I operated locally on that remote machine today. I ssh into is via VPN   Why did this happen? How can I solve this problem?
85084
I'm trying to do the following but it's not quite right.  cat ~/Desktop/blah.png | ssh -t -t trusktr@50.116.4.56 "cat | sudo -i 'cat | /path/to/blah.png'"   I have my public ssh key in the trusktr@50.116.4.56 user's .ssh folder, so no initial password is needed. When the sudo -i command finally starts, it prompts me for the root password, but immediately fails as if I had pressed enter but I didn't even touch the keyboard. I have a feeling maybe the cat command is being catted into the password prompt. The output looks like this:  trusktr@LENOVO-PC ~ $ cat ~/Desktop/win-8.1-missing-lockscreen-setting.png | ssh -t -t trusktr@50.116.4.56 "cat | sudo -i 'cat &gt; /srv/http/default/htdocs/~/img/win-8.1-missing-lockscreen-setting.png'" tcgetattr: Not a character device [sudo] password for root: You type like i drive. [sudo] password for root: Your mind just hasn't been the same since the electro-shock, has it? [sudo] password for root: Maybe if you used more than just two fingers... sudo: 3 incorrect password attempts Connection to 50.116.4.56 closed.   I don't have direct ssh access through the root user, only through a normal user with access to sudo using the root password.  How might I cat the image through ssh, through the non-root user, into the root location all in a single command?
49465
I had enabled root login before and tried to change its password using this . But after successfully changing the password and locking it via sudo passwd -dl root. I cannot login back to SSH, it says Access is denied.  I have two users on my machine. root and admin, admin does not have su permission. When I try to use sudo on admin user, it says that admin is not in the sudoers file. That is why i need my su user back.
119526
We are having a little problem on a server. We want that some users should be able to do e.g. sudo and become root, but with the restriction that the user can't change root password. That is, a guarantee that we still can login to that server and become root no matter of what the other users will do.  Is that possible?
7493
I don't care if I mess up the system (which is likely if I do things like this), or the potential security issues that this could imply. Note, that I don't just want to "", but run my GUI from bottom-up as root. I don't want to type my password for anything but just for login and have total control over it.  Of course, I want any application running as root, like Firefox, LibreOffice, etc. without having to mess up with the terminal. So, how do I do this?     This question tries to address users that do not like the current permission system with root being separated from normal users. I do not endorse such behaviors, but if a user wants to, for whatever reason, this question should fit their corncerns.   Not advisable for new users
81476
I want to unlock an encrypted LVM at startup on a headless Ubuntu 16.04 server. This is a fairly fresh install. The only installs I have done are mate-desktop, xrdp, dropbear, and busybox. My client is PuTTY on a Windows machine. I am fairly new to Linux, but here is the progress I have made:  Installed dropbear and busybox  Used puttygen to generate a key pair  Copied public key to ~/.ssh/authorized_keys and set proper permissions (700 on directory, 600 on file)  Copied public key to /etc/initramfs-tools/root/.ssh/authorized_keys and set proper permissions (700 on directory, 600 on file)  Confirmed my keys are good by successfully connecting to normal user session via PuTTY using key authentication  Created the script and modified the config files as outlined at  (Note: I did not perform step 8, but my /var/log/auth.log file did not contain the errors showcased in the Troubleshoot section of that blogpost if step 8 is not performed.)  Updated initramfs   When the system boots and shows the graphical LUKS unlock prompt, I get no response from the server when I try to connect via PuTTY. The connection times out. I have not been able to find any resources that deal with dropbear/busybox not running on boot. I am certain that if I could get a response, my key would work and I could unlock without problems. How can I find out why dropbear/busybox isn't running at boot? (For clarification, I can still unlock at the server and SSH into user session.)