All my files uploaded have unusable permissions

Question

I've just moved to a new server and have come across some strange permissions issues.

Every file I upload has permissions of 600, owned by the user account and is also in the same group. With this permission, the server is unable to make changes to these files.

The folder I'm uploading to (via regular sftp) has permissions of 755.

Why are any new files I upload here given this permission of 600? And how do I change it so that files added are given permissions so they can be modified by the webserver?

Note: I installed vsftpd which has a setting in it to determine the default umask. Logging in via this ftp it works as expected. This does not fix the problem however when logging in via sftp.

Answer 1

My basic solution to this, is to create a script that sits between SSH and SFTP and changes the umask as the user logs in:

> vim /opt/sftp-server.sh

#!/bin/bash
umask 022
/usr/libexec/openssh/sftp-server

Then edit the ssh_d config file (/etc/ssh/sshd_config) and edit the sftp SubSystem line to point to your script:

Subsystem       sftp    /opt/sftp-server.sh

Make sure you’ve set the permissions correctly on your new script:

> chmod 755 /opt/sftp-server.sh

Now files uploaded via SFTP should have the permissions 755!

http://blog.mrmason.net/2009/05/27/changing-default-file-permissions-for-sftp/

Answer 2

The sftp-server is the sftp subsystem generally used with openssh.

Upon closer inspection of the command:

$ /usr/lib/openssh/sftp-server -h
usage: sftp-server [-ehR] [-f log_facility] [-l log_level] [-u umask]

Therefore we can set the default umask for connections by passing the -u switch upon initialisation. In /etc/ssh/sshd_config where the sftp subsystem is defined find the line.

Subsystem sftp /usr/lib/openssh/sftp-server

and change it to look like:

Subsystem sftp /usr/lib/openssh/sftp-server -u 0022

To allow created files to have the default umask of 644 and files 755

Remember that this setting is global and will affect all files transferred over sftp so take security in to consideration before implementing.