Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to disable the ability to use the chmod command from sftp clients. I want files uploaded by users to only be set based on the umask and remove their ability to change it.

It seems like this should be simple, but I can't find any way to do it.

share|improve this question
up vote 4 down vote accepted

Not by default but there is a patch. Not sure if your distro has a patched package already but it may worth searching before you patch it yourself.

share|improve this answer

Alternatively if your sftp users belong to a specific common group and shell users another common group, you can simply utilize ACL (Access Control Lists) to limit who can use the chmod, along with other commands.

share|improve this answer
Do you mean actually setting an ACL for the chmod binary? – Joost Aug 19 '15 at 18:38

It's apparently not possible to do what I wanted without a massive patch to openssh. I wound up just using vsftpd instead.

share|improve this answer
it is possible. see my post – platinummonkey May 1 '12 at 1:48
sftp doesn't call the installed chmod command, it has one built in. If you were to rm $(which chmod) a user would still be able to run chmod from the sftp connection. – MTeck May 1 '12 at 14:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.