Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not able working on SFTP+chrooted env Using internal-sftp directive it works, but i'm not able to set umask. (ex umask 002) Using sftp-server from openssh package dosent't work because login shell for chrooted only user replay with /bin/false (file not found) This is a sshd server behaviour from:

My sshd config:

Match User sftponly
ChrootDirectory /mnt/www-prod-shared-jail/sftponly/
AllowTCPForwarding no
X11Forwarding no
#ForceCommand internal-sftp -u 002
ForceCommand /usr/lib/openssh/sftp-server
#ForceCommand /bin/sh -c 'umask 002; /usr/lib/openssh/sftp-server'

how do you solved this ? My chrooted environment , in home (chrooted) is /jail/user/bin/false

I try:

  • delete .bashrc
  • disabled /bin/bash in /etc/passwd setting /bin/false
  • try to recreate /bin/bash in choroot but nothing works.

Do you have any ideas ?

Thanks, Ema

share|improve this question

The internal sftp server is running as root and therefore picks up roots umask. you can fix this by forcing the umask e.g. in /etc/ssh/sshd_config change

Subsystem sftp /usr/lib/openssh/sftp-server


Subsystem sftp /bin/sh -c 'umask 0002; /usr/libexec/openssh/sftp-server'

or whatever umask you want.

share|improve this answer
I've tried this but it dosen't work. I think sshd replay to login with some error, like "bin/bahs not found" and login fails – emaaaa Apr 9 '11 at 8:07
emaaaa-s-mbp:~ emaaaa$ ssh myuser@myserver /usr/bin/true myuser@myserver's password: /bin/false: No such file or directory – emaaaa Apr 9 '11 at 9:15
Try again with ' as a quote and not ` – Iain Apr 9 '11 at 9:52
ssh myuser@myserver /usr/bin/true myuser@myserver's password: /bin/false: No such file or directory @lain – emaaaa Apr 9 '11 at 10:11

I ran into this recently. Specifying the umask in sshd_config works with sftp, but not with internal-sftp. Unfortunately, in order to jail the users without creating an entire chroot environment, you have to use internal-sftp. The good news is that there is still a way to set the umask if you're using PAM.

Create a group that contains all of your sftp users. For the example, let's call it sftpjail.

Then add the following to /etc/pam.d/login

session optional sftpjail umask=0002

This will set the umask for all the users in the sftpjail group.

EDIT If you want to use the config that you have above, I'm pretty sure what you're missing is the chroot environment (binaries, config files, etc.) - hence the "file not found" errors when it tries to chroot. Though if it were me, I'd go back to using "ForceCommand internal-sftp" and set the umask in PAM

share|improve this answer
Hi @Bill B I try this config on my server but It dosent' works. – emaaaa Apr 10 '11 at 20:43
@emaaaa It's working for me on several systems. My best guess is that you still have something misconfigured. – Bill B Apr 12 '11 at 14:10
I am currently using ForceCommand internal-sftp. So how do I set the umask in PAM? Is that the method you posted? If so, I couldn't get it to work. – Doug Aug 10 '11 at 0:33
@Doug - Yes, adding the above line to /etc/pam.d/login should enforce the umask of 0002 for all members of group sftpjail. Of course, your group name will be different. – Bill B Aug 10 '11 at 2:37

I had that problem, but I was using ssh on the client machine instead of sftp. As soon as I used sftp user@host instead of ssh user@host, it worked fine.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.