5

How do I make SCP respect umask ?

I've tried adding this

Subsystem      sftp  internal-sftp -u 0002

in /etc/ssh/sshd_config

and

session    optional     pam_umask.so umask=0002

in /etc/pam.d/sshd

Any other things to try?

each time scp creates the file as 644 instead of 664 as the umask would suggest

  • 2
    SFTP has nothing to do with scp. So your configuration in sshd_config is irrelevant. – jirib Nov 13 '13 at 11:05
  • So can i set the value for scp in the sshd config file in a similar way ? – exussum Nov 13 '13 at 11:50
  • 3
    Possible duplicate of unix.stackexchange.com/questions/16969/… – John B Nov 18 '13 at 0:02
  • Please give an example of the operation you are attempting. The solutions are probably different depending on whether you are copying to local or to remote. – Joe Atzberger Nov 18 '13 at 21:32
  • @JoeAtzberger scp local remote. remote dir is sticky bitted for group and should be 664 or 775 as standard – exussum Nov 18 '13 at 22:16
1

You can create a separate user for scp on the remote side, and set their umask through login.conf(5) (if on OpenBSD).

0

AFAIK, scp does not initialize a shell, thus don't source any file such as .profile, .bashrc, /etc/profile.

So the only way of doing this seems to use the pam module pam_umask.so. But it will be applied to all users (unless you use a more complicated PAM setup)

The file /etc/pam.d/sshd is probably the best place to do it, if you want to limit this behavior to ssh sessions :

session optional pam_umask.so umask=0007
  • 1
    This was mentioned in the question, It didnt work for me. though im not sure about the umask 0007 ? – exussum Jan 27 '15 at 9:16
  • My bad… I overlooked the question. Did you try to debug the module execution? – Christophe Drevet-Droguet Jan 27 '15 at 11:10
-1

I think you need to use something better to this like rsync command.

Taken from man:

Some of the additional features of rsync are:

   support for copying links, devices, owners, groups, and permissions

Syntax:

   Local:  rsync [OPTION...] SRC... [DEST]

   Access via remote shell:
     Pull: rsync [OPTION...] [USER@]HOST:SRC... [DEST]
     Push: rsync [OPTION...] SRC... [USER@]HOST:DEST

To preserve modification times, access times, and modes from the original file you can use -p after scp. But this is not what you are looking for.

  • I dont want to preserve information, I want to have it set as 664 instead of 644 – exussum Nov 19 '13 at 17:07
-1

what you are trying to do you can't achive with umask try to mask instead.

umask acts like this:

  • situation per default folders are created with 775 and files with 664 (owner/user read+write group read+write others read - folders also have set traverse for user group and others)

if one does not like this one can cut the roghts by e.g setting a umask like 027 wich means user no changes group -2 (default minus write) others -7 (default minus read/write/execute(traverse if folder)

to be simple: umask 027 ~= chmod g-w o-rwx

so with umask u can only lower/cut rights

to add/higher rights use mask

if you need to know more please read the man pages of umask and mask or have a look at the entry on wikipedia http://en.m.wikipedia.org/wiki/Umask

  • There is no mask command. umask is the right way to set the default mask. Besides, if you set the mask with umask 0000, new files will be created with 666 as permissions, and directories with 777. So this command does allow a higher permission than the default one. – Christophe Drevet-Droguet Jan 26 '15 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.