25

I have a SFTP server (openssh/sftp-server) and I would like to set umask 002 for users using this service. I tried setting PAM (pam.d/common-session), and .profile for each user, but no luck.

With SSH login everything is fine, but when I try with SFTP (with gFTP) I have the 022 umask set.

I already tried to use a wrapper for sftp-server that is changing the umask before calling the sftp-server, no luck.

Any help? Thanks a lot!

6 Answers 6

31

Since OpenSSH 5.4p1 I think, you can use the "-u" option, for example:

Subsystem sftp /usr/lib/openssh/sftp-server -u 022

From the man page:

 -u umask
         Sets an explicit umask(2) to be applied to newly-created files
         and directories, instead of the user's default mask.
6
  • that's nice!! I'll take a look ASAP and report my findings :)
    – mat_jack1
    Nov 7, 2010 at 22:21
  • 6
    For those w/o the -u option, this works: Subsystem sftp /bin/sh -c 'umask 0002; /usr/lib/openssh/sftp-server'
    – Steve Clay
    Jul 31, 2011 at 1:23
  • 1
    Good solution. It solves the problem with client shells and applications, such CyberDuck, that set their default permissions regardless of system umask. I found it useful to make sure that every client app will set the right permissions to let my users work together on group files. It may be useful to add also that this setting won't stop users from customizing file permissions if they wish.
    – gerlos
    Mar 3, 2014 at 0:14
  • One last thing to add: if you need only sftp feature and don't need to give your users shell access, you may consider also using rssh instead of bash for their shells, and setting default umask for them in /etc/rssh.conf. This may make your server more secure
    – gerlos
    Mar 3, 2014 at 0:18
  • 1
    Doesn't work for me with Subsystem sftp internal-sftp -u 022
    – leonheess
    May 13, 2020 at 10:34
7

I hope this can save someone else hours of frustration...

If you're using a GUI SFTP application, check its preferences for setting permissions on upload.

I had tried all the solutions above, and it turns out the application was just overriding them.

3
  • ^^ Yes, for a long time I've been setting the umask on sftp connection by making a script similar to Weboide's solution. Recently I was scratching my head as to why this didn't seem to work as well as it did in the past. Well apparently at some point an update to my SFTP client made it explicitly set the umask after connecting with ssh, so go figure.
    – Jared Kipe
    Mar 4, 2013 at 20:26
  • It's not just GUIs. Not even clients. It took me way too long to find that the test file I uploaded had 0600 which the client (OpenSSH sftp) copied to the remote side.
    – xebeche
    Nov 17, 2013 at 17:32
  • Thank you! Spent so long playing around with permissions for nothing. Jan 13, 2016 at 20:24
6

In the ssh config file you can also use this to set the mode of the file specifically (overriding any chmod that the client may try to set). Here I am using internal-sftp but I guess it would be the same for sftp-server:

ForceCommand internal-sftp -u 0022   
1
  • First answer that explicitly tells you to add this to the internal-sftp command. I'd added it to Subsystem sftp /usr/lib/openssh/sftp-server but that wasn't making a difference.
    – Frans
    Jul 14, 2022 at 6:11
2

After many hours trying to apply various hacks and fixes i've found a proper solution!

There's a patch for SSH that permits you to chose the umask that you want for SFTP. You can download it here: http://sftpfilecontrol.sourceforge.net/

For me (OpenSSH_5.2p1+sftpfilecontrol-v1.3, OpenSSL 0.9.8g 19 Oct 2007) it's working perfectly!

1
  • 2
    Just to note that the option '-u' to set the umask is available in OpenSSH since 5.4p1, see my answer further down.
    – Weboide
    Nov 17, 2010 at 18:20
1

To quote this message:

I got this working okay by adding a "umask 007" line in /etc/init.d/ssh.

Bash uses the .profile for interactive login shells. I don't think sftp counts as one. You might be able to set the umask in /etc/bash.bashrc or ~/.bashrc if the tip above doesn't work or you want more fine-grained control.

2
  • 2
    thanks for the answer, but i had already in ssh umask 002 (i tried also 0002) and it's not working :( also the bashrc is not taken into consideration, as with an external SFTP client i don't think that bash is used. If i log directly with ssh everything is fine. My problem is only with SFTP clients. Thanks!
    – mat_jack1
    Oct 2, 2009 at 18:59
  • Oops, you're right. I don't know why I was thinking about Bash being involved. Oct 2, 2009 at 19:21
0

Refer to this question to find a simple solution that doesn't require specific openssh versions nor custom patches.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .