Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I tried to override umask setting on SFTP connection in chrooted env. I couldnt use subsytem diffrente than internal-ftp.

In OpenSSH_5.3p1 (Debian-3ubuntu4, OpenSSL 0.9.8k 25 Mar 2009) there's umask setting directly from command.

How do you able to set ?

My sshd config is:

Match User myuser
ChrootDirectory /mnt/jail/myuser/
AllowTCPForwarding no
X11Forwarding no
#ForceCommand /usr/lib/openssh/sftp-server -l DEBUG3
#ForceCommand /bin/sh -c 'umask 002; /usr/lib/openssh/sftp-server'
ForceCommand internal-sftp -u 002

anyway, it dosent works.

share|improve this question
up vote 1 down vote accepted

If you do not want the patch solution, here is another workaround:

In sshd_config:

# Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp /usr/local/bin/sftpwrapper

# And the Match Group, ChrootDirectory, etc... declarations

And in /usr/local/bin/sftpwrapper (chmod 755, chown root:root)

#!/bin/bash --
umask 0002
exec /usr/lib/openssh/sftp-server

Users in the chrooted group, can still has /bin/false as shell.

share|improve this answer
I've tried even this solution but sftp-server couldnt start from sshd and when i tried to use Cyberduck sftp-server respond with "/bin/bash not found" dosen't accept any connection – emaaaa Apr 9 '11 at 18:15
You can change first line to something like "#!/usr/bin/env bash" or the right path to the bash interpreter on your server. – poisonbit Apr 10 '11 at 9:18
Sorry @poisonbit i catch this error when i try to login with an user without shell. It should say nothing, but ... – emaaaa Apr 10 '11 at 20:42

There is a patch you might want to look at which adds a SftpUmask option to sshd_config.

You can also use pam_umask per this thread. In /etc/pam.d/sshd:

session    optional umask=0002
share|improve this answer
I couldnt fix sshd daemon with sftpfilecontrol BTW I've tried to insert pam_umask but seems dosent work – emaaaa Apr 9 '11 at 18:14
I was able to get it to work putting the pam_umask line at the top of /etc/pam.d/sshd and restarting. I'm using /usr/lib/openssh/sftp-server; I didn't try it with internal-sftp. – Cakemox Apr 9 '11 at 18:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.