Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a SFTP server (openssh/sftp-server) and I would like to set umask 002 for users using this service. I tried setting PAM (pam.d/common-session), and .profile for each user, but no luck.

With SSH login everything is fine, but when I try with SFTP (with gFTP) I have the 022 umask set.

I already tried to use a wrapper for sftp-server that is changing the umask before calling the sftp-server, no luck.

Any help? Thanks a lot!

share|improve this question

5 Answers 5

I hope this can save someone else hours of frustration...

If you're using a GUI SFTP application, check its preferences for setting permissions on upload.

I had tried all the solutions above, and it turns out the application was just overriding them.

share|improve this answer
    
^^ Yes, for a long time I've been setting the umask on sftp connection by making a script similar to Weboide's solution. Recently I was scratching my head as to why this didn't seem to work as well as it did in the past. Well apparently at some point an update to my SFTP client made it explicitly set the umask after connecting with ssh, so go figure. –  Jared Kipe Mar 4 '13 at 20:26
    
It's not just GUIs. Not even clients. It took me way too long to find that the test file I uploaded had 0600 which the client (OpenSSH sftp) copied to the remote side. –  xebeche Nov 17 '13 at 17:32

Refer to this question to find a simple solution that doesn't require specific openssh versions nor custom patches.

share|improve this answer

Since OpenSSH 5.4p1 I think, you can use the "-u" option, for example:

Subsystem sftp /usr/lib/openssh/sftp-server -u 022

From the man page:

 -u umask
         Sets an explicit umask(2) to be applied to newly-created files
         and directories, instead of the user's default mask.
share|improve this answer
    
that's nice!! I'll take a look ASAP and report my findings :) –  mat_jack1 Nov 7 '10 at 22:21
3  
For those w/o the -u option, this works: Subsystem sftp /bin/sh -c 'umask 0002; /usr/lib/openssh/sftp-server' –  Steve Clay Jul 31 '11 at 1:23
    
Good solution. It solves the problem with client shells and applications, such CyberDuck, that set their default permissions regardless of system umask. I found it useful to make sure that every client app will set the right permissions to let my users work together on group files. It may be useful to add also that this setting won't stop users from customizing file permissions if they wish. –  gerlos Mar 3 at 0:14
    
One last thing to add: if you need only sftp feature and don't need to give your users shell access, you may consider also using rssh instead of bash for their shells, and setting default umask for them in /etc/rssh.conf. This may make your server more secure –  gerlos Mar 3 at 0:18
up vote 2 down vote accepted

After many hours trying to apply various hacks and fixes i've found a proper solution!

There's a patch for SSH that permits you to chose the umask that you want for SFTP. You can download it here: http://sftpfilecontrol.sourceforge.net/

For me (OpenSSH_5.2p1+sftpfilecontrol-v1.3, OpenSSL 0.9.8g 19 Oct 2007) it's working perfectly!

share|improve this answer
1  
Just to note that the option '-u' to set the umask is available in OpenSSH since 5.4p1, see my answer further down. –  Weboide Nov 17 '10 at 18:20

To quote this message:

I got this working okay by adding a "umask 007" line in /etc/init.d/ssh.

Bash uses the .profile for interactive login shells. I don't think sftp counts as one. You might be able to set the umask in /etc/bash.bashrc or ~/.bashrc if the tip above doesn't work or you want more fine-grained control.

share|improve this answer
2  
thanks for the answer, but i had already in ssh umask 002 (i tried also 0002) and it's not working :( also the bashrc is not taken into consideration, as with an external SFTP client i don't think that bash is used. If i log directly with ssh everything is fine. My problem is only with SFTP clients. Thanks! –  mat_jack1 Oct 2 '09 at 18:59
    
Oops, you're right. I don't know why I was thinking about Bash being involved. –  Dennis Williamson Oct 2 '09 at 19:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.