sudoers.d: Allow user to not need password for sftp only

Question

In WinSCP, I want to be able to have sudo access. In WinSCP, Advanced > SFTP > SFTP Server: sudo su -c /usr/lib/openssh/sftp-server

In Ubuntu 22.04.1:

echo "user1 ALL=(ALL) NOPASSWD: ALL" | sudo tee "/etc/sudoers.d/user1-user"

I successfully have sudo access in WinSCP.

But I don't want to permit no password for everything. Just sftp-server. So I changed ALL to /usr/lib/openssh/sftp-server:

user1 ALL=(ALL) NOPASSWD: /usr/lib/openssh/sftp-server

In WinSCP, I get the error:

Cannot initialize SFTP protocol. Is the host running an SFTP server?

Why? Is this a problem with my syntax in Ubuntu? Or a problem with WinSCP or my settings within WinSCP?

sftp-server is found in /usr/lib/openssh/

Answer 1

I had previously tried user1 ALL=(ALL) NOPASSWD: su -c /usr/lib/openssh/sftp-server but it didn't work. Of course it didn't work. I forgot that I need the full path for su which is /usr/bin/su. Thanks pasman pasmański!

The correct way of restricting passwordless sudo for sftp is the following:

user1 ALL=(ALL) NOPASSWD: /usr/bin/su -c /usr/lib/openssh/sftp-server