SFTP permissions for www-data user - Need help!

Question

I followed this guide { http://john.parnefjord.se/node/62 } to setup another user (joeuser) in the www-data group, but the unmask isn't being set in spite of these changes. The folder under /var/www/example.com/ is now owned by www-data group, but only www-data user can modify it. I have followed and re-followed every step mentioned in that howto.

I uncommented the echo statement in the below script:

#!/bin/bash
#/bin/echo `/bin/date` > /tmp/sftp-test.txt
#/bin/echo 'Starting SFTP server from wrapper script to set correct umask...' >> /tmp/sftp-test.txt
umask 0002;
/usr/lib/openssh/sftp-server

But nothing is being echoed / logged. I guess that means the script isn't being run. Now how can I trace what's happening when joeuser is logging in? The server is running Ubuntu 11.4.

Answer 1

You are correct that this does indicate the script is not being run at all, which means the umask is not being set, so the file/folders will not be created with the correct permissions.

Is this on an Ubuntu system?

Could you post the output of ls -l /usr/lib/openssh/ and cat /etc/ssh/sshd_config | grep Subsystem

Update: I actually got this to work by renaming the sftp-server to sftp-server.orig and then creating a script named sftp-server with this in it:

#!/bin/bash
umask 002
/usr/lib/openssh/sftp-server.orig

Be sure to chmod +x. I also restarted the ssh service, but that was probably not necessary in this case.

I did find out, though, that openssh 5.4 has an option for setting sftp umask, so there may be a less hackish way to do this in the future, but the Ubuntu Lucid server I tried this on was at version 5.3.

Also, I connected using a laptop with Ubuntu Maverick using the Nautilus sftp client. It would create directories with the proper umask, but it would NOT create files with the correct umask. I suspect this is an issue with the Nautilus client forcing the umask on the created files, and may work correctly if using a client such as filezilla or winscp. Update: I just verified that files copied up using winscp do have the correct file permissions. That is unfortunate about the Nautilus sftp client.

You might also try something like this: http://en.positon.org/post/A-solution-to-the-umask-problem%3A-inotify-to-force-permissions