I've just moved to a new server and have come across some strange permissions issues.

Every file I upload has permissions of 600, owned by the user account and is also in the same group. With this permission, the server is unable to make changes to these files.

The folder I'm uploading to (via regular sftp) has permissions of 755.

Why are any new files I upload here given this permission of 600? And how do I change it so that files added are given permissions so they can be modified by the webserver?

Note: I installed vsftpd which has a setting in it to determine the default umask. Logging in via this ftp it works as expected. This does not fix the problem however when logging in via sftp.

  • 1
    This is probably the default umask setting of your FTP daemon. Let us know what software you are using so we can tell you what setting to look at. – James Park-Watt Nov 6 '12 at 5:54
  • I think you could be right. I haven't run into umask before and am trying to wrap my head around it. I'm running CentOS 6.3 on the server. Uploading files via regular FTP program. – willdanceforfun Nov 6 '12 at 5:58
  • I mean what FTP daemon you are using, vsftpd, proftpd etc... – James Park-Watt Nov 6 '12 at 6:04
  • Ahh - my bad. Trying to work out how to find this out now. – willdanceforfun Nov 6 '12 at 7:16
  • @cosmicbdog Try: ps -ef | grep ftp and see what the path is to your ftp daemon. – Wesley Nov 6 '12 at 7:27

My basic solution to this, is to create a script that sits between SSH and SFTP and changes the umask as the user logs in:

> vim /opt/sftp-server.sh

umask 022

Then edit the ssh_d config file (/etc/ssh/sshd_config) and edit the sftp SubSystem line to point to your script:

Subsystem       sftp    /opt/sftp-server.sh

Make sure you’ve set the permissions correctly on your new script:

> chmod 755 /opt/sftp-server.sh

Now files uploaded via SFTP should have the permissions 755!



The sftp-server is the sftp subsystem generally used with openssh.

Upon closer inspection of the command:

$ /usr/lib/openssh/sftp-server -h
usage: sftp-server [-ehR] [-f log_facility] [-l log_level] [-u umask]

Therefore we can set the default umask for connections by passing the -u switch upon initialisation. In /etc/ssh/sshd_config where the sftp subsystem is defined find the line.

Subsystem sftp /usr/lib/openssh/sftp-server

and change it to look like:

Subsystem sftp /usr/lib/openssh/sftp-server -u 0022

To allow created files to have the default umask of 644 and files 755

Remember that this setting is global and will affect all files transferred over sftp so take security in to consideration before implementing.

  • I tried this, but it seems I can enter -u 0022, or -u 0002, or even -u 0000 and I only end up with file permissions of 644. So I'm not sure this is the overriding setting / config to change. – willdanceforfun Nov 6 '12 at 13:45
  • Did you restart the ssh daemon when the configuration was changed? /etc/init.d/sshd restart – James Park-Watt Nov 6 '12 at 14:30
  • Yes - and reboot as well. Any other ideas what effects this? – willdanceforfun Nov 6 '12 at 14:57
  • I'm stumped, It must be coming from your client. Which client are you using? – James Park-Watt Nov 6 '12 at 15:34
  • Possibly. I'll try another client. Nope - same issue :| – willdanceforfun Nov 6 '12 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.