1

I tried to override umask setting on SFTP connection in chrooted env. I couldnt use subsytem diffrente than internal-ftp.

In OpenSSH_5.3p1 (Debian-3ubuntu4, OpenSSL 0.9.8k 25 Mar 2009) there's umask setting directly from command.

How do you able to set ?

My sshd config is:

Match User myuser
ChrootDirectory /mnt/jail/myuser/
AllowTCPForwarding no
X11Forwarding no
#ForceCommand /usr/lib/openssh/sftp-server -l DEBUG3
#ForceCommand /bin/sh -c 'umask 002; /usr/lib/openssh/sftp-server'
ForceCommand internal-sftp -u 002

anyway, it dosent works.

2 Answers 2

1

If you do not want the patch solution, here is another workaround:

In sshd_config:

# Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp /usr/local/bin/sftpwrapper

# And the Match Group, ChrootDirectory, etc... declarations

And in /usr/local/bin/sftpwrapper (chmod 755, chown root:root)

#!/bin/bash --
umask 0002
exec /usr/lib/openssh/sftp-server

Users in the chrooted group, can still has /bin/false as shell.

3
  • I've tried even this solution but sftp-server couldnt start from sshd and when i tried to use Cyberduck sftp-server respond with "/bin/bash not found" dosen't accept any connection
    – emaaaa
    Apr 9, 2011 at 18:15
  • You can change first line to something like "#!/usr/bin/env bash" or the right path to the bash interpreter on your server.
    – poisonbit
    Apr 10, 2011 at 9:18
  • Sorry @poisonbit i catch this error when i try to login with an user without shell. It should say nothing, but ...
    – emaaaa
    Apr 10, 2011 at 20:42
0

There is a patch you might want to look at which adds a SftpUmask option to sshd_config.

http://sftpfilecontrol.sourceforge.net/

You can also use pam_umask per this thread. In /etc/pam.d/sshd:

session    optional     pam_umask.so umask=0002
2
  • I couldnt fix sshd daemon with sftpfilecontrol BTW I've tried to insert pam_umask but seems dosent work
    – emaaaa
    Apr 9, 2011 at 18:14
  • I was able to get it to work putting the pam_umask line at the top of /etc/pam.d/sshd and restarting. I'm using /usr/lib/openssh/sftp-server; I didn't try it with internal-sftp.
    – Cakemox
    Apr 9, 2011 at 18:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .