How can I allow SFTP connections with SSH keys only on Ghost one click install app server?

Posted May 2, 2016 4.4k views
UbuntuGhostDigitalOcean 1-Click Apps Marketplace

I have SSH keys setup for access for root and the one regular user I added.

I would like to:

Disable remote root login of any kind.

Allow user1 to sudo without password once logged in via SSH keys.

Disallow remote logins of any kind without SSH keys (disable password use completely).

Allow SFTP connections with SSH keys only.

Can anyone help by telling em the steps I have to take?

This app install runs Ubuntu 14.04


These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Submit an Answer
2 answers

The tutorial Initial Server Setup with Ubuntu 14.04 will walk you through creating a non-root accout with SSH keys and disabling SSH access completely for the root account. Since SFTP uses SSH, once you’ve set that up, SFTP access will also be disabled for the root user.

That should point you in the right direction. Let us know if you run into any problems!

by Justin Ellingwood
SFTP is a secure way to transfer files between local and remote servers. Much more secure than FTP, this protocol uses an SSH tunnel to establish a connection and uses encryption to transfer files in an interactive session.
  • The tutorial only answers some of the original question. What about:

    1) Let new user sudo and/or su with no password? I still get prompted for a password after following the tutorial if I try to use sudo or su.

    2) How can password login for ALL users be disabled and force the use of SSH keys?

    I can’t use sudo at all right now because it prompts me for a password if I try. I want to completely dispense with the use of passwords and use keys only with no root login.


Here is the answer without thousands of words and external links in three simple steps.

Add the line below to /etc/sudoers


Edit /etc/ssh/sshd_config and change (and uncomment if necessary) the line, default is probably ‘yes’:

PermitRootLogin no

Also edit/change/uncomment:

PasswordAuthentication no