以Ubuntu为例，首先先用root用户登入SSH，然后新建一个用户，并修改其密码，这里使用用户名为username：
|
1 2 3 |
useradd -d "/home/username" -m -s "/bin/bash" username passwd username # 然后根据提示输入密码 |
接着将用户加入到sudo用户组中，使得该用户可以使用sudo命令提权：
|
1 |
usermod -a -G sudo username |
接着将SSH key公钥填写在 /home/username/.ssh/authorized_keys 文件中，此时即可利用新的用户username登录了。
不过当你使用WinSCP文件管理器的时候，使用非root用户会很麻烦，因为这类软件登录后无法再提权，因此无法操作全部文件。不过有种方法可以解决。首先先看一下sftp-server在哪个位置（不同系统可能位置不同）：
|
1 2 3 |
cat /etc/ssh/sshd_config | grep sftp # 下面是返回结果 Subsystem sftp /usr/lib/openssh/sftp-server |
/usr/lib/openssh/sftp-server 就是sftp-server的路径
接着用visudo命令编辑 /etc/sudoers 文件，sudoers在Ubuntu 16.04版本中默认内容如下：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
# # This file MUST be edited with the 'visudo' command as root. # # Please consider adding local content in /etc/sudoers.d/ instead of # directly modifying this file. # # See the man page for details on how to write a sudoers file. # Defaults env_reset Defaults mail_badpass Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin" # Host alias specification # User alias specification # Cmnd alias specification # User privilege specification root ALL=(ALL:ALL) ALL # Members of the admin group may gain root privileges %admin ALL=(ALL) ALL # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL # See sudoers(5) for more information on "#include" directives: #includedir /etc/sudoers.d |
在最后加入一行，此行的作用是让username用户可以在不输入用户密码的情况下提权执行sftp-server（因为sudo提权时候需要tty中输入密码，但是SFTP中无法实现，因此需要SFTP提权执行时候不输入密码才能正常连接）：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
# # This file MUST be edited with the 'visudo' command as root. # # Please consider adding local content in /etc/sudoers.d/ instead of # directly modifying this file. # # See the man page for details on how to write a sudoers file. # Defaults env_reset Defaults mail_badpass Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin" # Host alias specification # User alias specification # Cmnd alias specification # User privilege specification root ALL=(ALL:ALL) ALL # Members of the admin group may gain root privileges %admin ALL=(ALL) ALL # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL username ALL=NOPASSWD: /usr/lib/openssh/sftp-server # See sudoers(5) for more information on "#include" directives: #includedir /etc/sudoers.d |
然后注意这行不能添加到前面，因为后面的设置会覆盖掉前面的，比如说 %sudo ALL=(ALL:ALL) ALL 允许sudo用户组以任何用户身份执行任何程序，然而没有NOPASSWD选项，因此不能免密码，如果这行在下面就会使得前面设置的NOPASSWD失效了。
然后编辑 /etc/ssh/sshd_config ，一是禁止root用户登录，二是禁止纯密码登录，三是为sftp命令添加sudo使得SFTP连接后直接获取root权限：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 |
# Package generated configuration file # See the sshd_config(5) manpage for details # What ports, IPs and protocols we listen for Port 5000 # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress :: #ListenAddress 0.0.0.0 Protocol 2 # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key #Privilege Separation is turned on for security UsePrivilegeSeparation yes # Lifetime and size of ephemeral version 1 server key KeyRegenerationInterval 3600 ServerKeyBits 1024 # Logging SyslogFacility AUTH LogLevel INFO # Authentication: LoginGraceTime 120 PermitRootLogin no StrictModes yes RSAAuthentication yes PubkeyAuthentication yes #AuthorizedKeysFile %h/.ssh/authorized_keys # Don't read the user's ~/.rhosts and ~/.shosts files IgnoreRhosts yes # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # similar for protocol version 2 HostbasedAuthentication no # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes # To enable empty passwords, change to yes (NOT RECOMMENDED) PermitEmptyPasswords no # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) ChallengeResponseAuthentication no # Change to no to disable tunnelled clear text passwords PasswordAuthentication no # Kerberos options #KerberosAuthentication no #KerberosGetAFSToken no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes #UseLogin no #MaxStartups 10:30:60 #Banner /etc/issue.net # Allow client to pass locale environment variables AcceptEnv LANG LC_* Subsystem sftp sudo /usr/lib/openssh/sftp-server # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. UsePAM yes |
这样就可以使得WinSCP登录username的同时拥有root权限，从而可以直接访问更改所有文件。同时如果PuTTY打开的话，就是普通的使用username登录，使用sudo则可提权，sudo时候输入用户密码即可。