3

I'm trying to disable the ability to use the chmod command from sftp clients. I want files uploaded by users to only be set based on the umask and remove their ability to change it.

It seems like this should be simple, but I can't find any way to do it.

4 Answers 4

4

Not by default but there is a patch. Not sure if your distro has a patched package already but it may worth searching before you patch it yourself. http://sftpfilecontrol.sourceforge.net/

3

Alternatively if your sftp users belong to a specific common group and shell users another common group, you can simply utilize ACL (Access Control Lists) to limit who can use the chmod, along with other commands.

1
  • Do you mean actually setting an ACL for the chmod binary?
    – Joost
    Aug 19, 2015 at 18:38
3

(In 2023) this is possible with vanilla openSSH.

The according request is setstat.

So if you specify the following in your /etc/ssh/sshd_config:

Match User mysftpuser
 ChrootDirectory /home/mysftpuser/chroot #or else they see their .ssh dir
 ForceCommand internal-sftp -P lsetstat,setstat,fsetstat #deny chmod

it will do just that. I added lsetstat and fsetstat as well, as these do the same for links and file handles. You can also add -u xxxx to specify a given umask. See /usr/lib/openssh/sftp-server -Q requests for a list of requests you can blacklist. Or probably (even better) just whitelist only those needed.

You need to reload sshd and re-login with your SFTP client for changes to take effect.

I think the accepted answer should be changed to this one, as the accepted one is incorrect (now).

1

It's apparently not possible to do what I wanted without a massive patch to openssh. I wound up just using vsftpd instead.

2
  • it is possible. see my post May 1, 2012 at 1:48
  • sftp doesn't call the installed chmod command, it has one built in. If you were to rm $(which chmod) a user would still be able to run chmod from the sftp connection.
    – MTeck
    May 1, 2012 at 14:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .