up vote 6 down vote favorite
3
share [g+] share [fb]

I have a SFTP server (openssh/sftp-server) and I would like to set umask 002 for users using this service. I tried setting PAM (pam.d/common-session), and .profile for each user, but no luck.

With SSH login everything is fine, but when I try with SFTP (with gFTP) I have the 022 umask set.

I already tried to use a wrapper for sftp-server that is changing the umask before calling the sftp-server, no luck.

Any help? Thanks a lot!

link|improve this question
feedback

6 Answers

up vote 8 down vote

Since OpenSSH 5.4p1 I think, you can use the "-u" option, for example:

Subsystem sftp /usr/lib/openssh/sftp-server -u 022

From the man page:

 -u umask
         Sets an explicit umask(2) to be applied to newly-created files
         and directories, instead of the user's default mask.
link|improve this answer
that's nice!! I'll take a look ASAP and report my findings :) – mat_jack1 Nov 7 '10 at 22:21
1  
For those w/o the -u option, this works: Subsystem sftp /bin/sh -c 'umask 0002; /usr/lib/openssh/sftp-server' – mrclay Jul 31 '11 at 1:23
feedback
up vote 2 down vote accepted

After many hours trying to apply various hacks and fixes i've found a proper solution!

There's a patch for SSH that permits you to chose the umask that you want for SFTP. You can download it here: http://sftpfilecontrol.sourceforge.net/

For me (OpenSSH_5.2p1+sftpfilecontrol-v1.3, OpenSSL 0.9.8g 19 Oct 2007) it's working perfectly!

link|improve this answer
Just to note that the option '-u' to set the umask is available in OpenSSH since 5.4p1, see my answer further down. – Weboide Nov 17 '10 at 18:20
feedback
up vote 2 down vote

I hope this can save someone else hours of frustration...

If you're using a GUI SFTP application, check its preferences for setting permissions on upload.

I had tried all the solutions above, and it turns out the application was just overriding them.

link|improve this answer
feedback
up vote 0 down vote

To quote this message:

I got this working okay by adding a "umask 007" line in /etc/init.d/ssh.

Bash uses the .profile for interactive login shells. I don't think sftp counts as one. You might be able to set the umask in /etc/bash.bashrc or ~/.bashrc if the tip above doesn't work or you want more fine-grained control.

link|improve this answer
thanks for the answer, but i had already in ssh umask 002 (i tried also 0002) and it's not working :( also the bashrc is not taken into consideration, as with an external SFTP client i don't think that bash is used. If i log directly with ssh everything is fine. My problem is only with SFTP clients. Thanks! – mat_jack1 Oct 2 '09 at 18:59
Oops, you're right. I don't know why I was thinking about Bash being involved. – Dennis Williamson Oct 2 '09 at 19:21
feedback
up vote 0 down vote

Refer to this question to find a simple solution that doesn't require specific openssh versions nor custom patches.

link|improve this answer
feedback
up vote 0 down vote

I try this solutions, in chrooted env but some client (ex. Cyberduck) dosent like it.

I think this client execute a pre-login auth, but server replay with a: "bin/bash or /bin/false dosent exist" (we're in chrooted env) Which could confuse Cyberduck.

How do you made sftp-server work ?

Thanks.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.