Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

The suggestion found at these links works for me:

Summary: Use PAM to inject the umask, using the following line in /etc/pam.d/sshd

session    optional     pam_umask.so umask=0027

However this only works for taking away permissiveness on the files/directories in question. i.e. I found it to work, but only to further restrict the umask.

For example, setting the umask to 0077 works.

However, increasing permissiveness, such as allowing default group write access, does not work.

There seems to be some underlying default umask that I cannot override.

I have tried changing the umask in the following places, as well:

  • /etc/init.d/ssh => Doesn't work unless I upgrade to OpenSSH 5.4, which is not going to happen (there is an additional directive to set umask for the internal-sftp option in the newest OpenSSH)
  • /etc/init/ssh.conf => didn't work
  • /etc/login.defs => didn't work
  • /etc/pam.d/sshd => didn't work
  • /etc/profile=> didn't work. Profile is not hit by SFTP since it isn't an interactive shell
  • /etc/ssh/sshd_config => didn't work

None worked. How can I allow more permissive masking for OpenSSH Chrooted SFTP?

Requirements:

  • Works with configuration only (i.e. no patching, no distro upgrades)
  • Works for Ubuntu 10.04LTS
  • Works for OpenSSH_5.3p1 Debian-3ubuntu4, OpenSSL 0.9.8k 25 Mar 2009
share|improve this question

1 Answer 1

Use the right tool for the job. Upgrade to a version of SSH that provides the functionality you need. Would you get dialup Internet and then complain that you needed 10Mbps? No, you'd go buy DSL. Same thing here.

share|improve this answer
    
Thanks, but "upgrade" does not always work. There is a larger context to consider, that of the overall infrastructure, how it is managed, and the scope of the upgrade. The DSL v Dialup analogy just doesn't fit at all. Not to mention I specified that I couldn't do an upgrade in the original question. –  JDS Jul 12 '11 at 2:29
    
No such thing as "can't upgrade". There might be "it is difficult to upgrade", but when your options are limited to "upgrade, get the functionality" or "don't upgrade, don't get the functionality", the answer isn't to stamp your foot and pout. –  womble Jul 12 '11 at 5:10
    
don't be a prick, just stick to answering the question. –  JDS Jul 12 '11 at 17:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.