16

We have an Ubuntu 10.04 server. How can I set it so that new files created (or copied) over SFTP or SSH have g+rw and g+rwx permissions (where appropriate)?

I'm also using setgid (chmod g+s) so that they inherit the proper group owner.

2 Answers 2

13

In /etc/ssh/sshd_config, you can pass a flag and value in (-u 0002) like the following to set the umask value:

Subsystem sftp /usr/lib/openssh/sftp-server -u 0002

Append the -u 0002 to the existing Subsystem sftp line of the configuration file.

Afterwards, you will need to restart ssh for the changes to take effect:

service ssh restart
4
  • This only applies to newer versions of OpenSSH, but should be the preferred solution where possible.
    – Andrew B
    Jan 12, 2013 at 6:27
  • 2
    This only works if you need more restrictive permissions than what is set by the client, not more loose.
    – Joost
    Aug 19, 2015 at 18:52
  • As Joost said, this doesn't help to force group-write permissions. I would help to forbid group-write.
    – flight
    Sep 10, 2015 at 15:46
  • According to recent documentation, the same options can be used with Subsystem sftp internal-sftp. Oct 9, 2015 at 12:27
10

In /etc/ssh/sshd_config, change the following:

Subsystem sftp /usr/lib/openssh/sftp-server

to:

Subsystem sftp /bin/sh -c 'umask 0002; exec /usr/libexec/openssh/sftp-server'

Soure: http://jeff.robbins.ws/articles/setting-the-umask-for-sftp-transactions

6
  • 1
    It's better to put an exec before the final /usr/.../sftp-server, so that you won't have useless sh processes lying around. Jun 13, 2010 at 20:32
  • Also, an umask is just a number; 0002 can be written shorter as 02. Jun 13, 2010 at 20:33
  • I thought umask was an octal, but thanks for the exec part.
    – wag2639
    Jun 16, 2010 at 15:38
  • 2
    Yes, umasks are octal. That doesn't mean you need three leading zeroes - one is enough. (In fact, the umask command doesn't need any leading zeroes, it always reads the argument as an octal number.) ... But on the second thought, maybe 0002 is clearer to understand. Jun 19, 2010 at 20:52
  • 2
    This doesn't work for me. It won't enforce the g+w permission.
    – flight
    Sep 10, 2015 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .