This issue is actually very, very serious. His behavior does not sound like much of a security “professional” to me. However, he never even attempted to contact me to raise his concern or ask for a response. Supposedly he crawled and emailed developers for hundreds of sites. Just to reiterate, I highly recommend anyone using the plugin use SFTP with an SSH key.Īlso, the author of that blog has contemptible security practices. The market spoke and demanded FTP support, so I added it. I was not planning on supporting FTP due to the security issues related to it. If you notice, the plugin was originally designed to just be SFTP, hence the name SFTP. In the next release I am planning on offering an option or storing your configuration files in a separate location, and I have the intention of exploring integration with popular password vaults. SFTP without SSH keys requires that you either type in your password for every connection attempt, or you have it stored somewhere on disk. If you care about security, which you should, you should be using SFTP and SSH keys. It should be pretty obvious to most users to not do that…

So you have to open the file and execute “Upload file” or right click on the file and click “Upload”. So I am looking for a more secure way to execute sudo at every file operation when I am using my SFTP client (which is a Sublime Text plugin), this plugin: codexns.io/products/sftp_for_sublime.Just to be clear - the plugin NEVER uploads the the config file - unless you explicitly ask for the file to be uploaded. But I was told this is not a secure way to enable sudo at file save, because then every client that connects with the correct credentials will be root, not just my own client. So I added 'sudo' in the sftp subsystem path in my sshd_config file on the server, and it works - it can save with root privileges, it has the same result as if people would add 'sudo' in the winSCP client settings at the sftp path. Because I connect the editors SFTP client with a user from the wheel group that can be root in a passwordless way when executing sudo su.Īnd I have disabled root login to secure SSH. I thought there is some linux command or file that can be edited that would enable me to execute sudo at every file save, and even at every file open. I am using Sublime Text editor with its SFTP plugin to edit files (also root files) on my server.

Sublime text sftp stop