How can I allow SFTP connections with SSH keys only on Ghost one click install app server?

May 2, 2016 1.9k views
Ghost One-Click Install Apps Ubuntu
setec
By:
setec

I have SSH keys setup for access for root and the one regular user I added.

I would like to:

Disable remote root login of any kind.

Allow user1 to sudo without password once logged in via SSH keys.

Disallow remote logins of any kind without SSH keys (disable password use completely).

Allow SFTP connections with SSH keys only.

Can anyone help by telling em the steps I have to take?

This app install runs Ubuntu 14.04

Thanks.

Log In to Comment
2 Answers
asb MOD May 2, 2016

The tutorial Initial Server Setup with Ubuntu 14.04 will walk you through creating a non-root accout with SSH keys and disabling SSH access completely for the root account. Since SFTP uses SSH, once you've set that up, SFTP access will also be disabled for the root user.

That should point you in the right direction. Let us know if you run into any problems!

How To Use SFTP to Securely Transfer Files with a Remote Server
SFTP is a secure way to transfer files between local and remote servers. Much more secure than FTP, this protocol uses an SSH tunnel to establish a connection and uses encryption to transfer files in an interactive session.
Reply
  • bn520995 May 9, 2016

    The tutorial only answers some of the original question. What about:

    1) Let new user sudo and/or su with no password? I still get prompted for a password after following the tutorial if I try to use sudo or su.

    2) How can password login for ALL users be disabled and force the use of SSH keys?

    I can't use sudo at all right now because it prompts me for a password if I try. I want to completely dispense with the use of passwords and use keys only with no root login.

    Thanks.

bn520995 May 9, 2016

Here is the answer without thousands of words and external links in three simple steps.

Add the line below to /etc/sudoers

username ALL=(ALL) NOPASSWD:ALL

Edit /etc/ssh/sshd_config and change (and uncomment if necessary) the line, default is probably 'yes':

PermitRootLogin no

Also edit/change/uncomment:

PasswordAuthentication no
Reply
Have another answer? Share your knowledge.

Related Questions