How do I make SCP respect umask ?

I've tried adding this

Subsystem      sftp  internal-sftp -u 0002

in /etc/ssh/sshd_config


session    optional     pam_umask.so umask=0002

in /etc/pam.d/sshd

Any other things to try?

each time scp creates the file as 644 instead of 664 as the umask would suggest

  • 2
    SFTP has nothing to do with scp. So your configuration in sshd_config is irrelevant.
    – jirib
    Commented Nov 13, 2013 at 11:05
  • So can i set the value for scp in the sshd config file in a similar way ?
    – exussum
    Commented Nov 13, 2013 at 11:50
  • 3
    Possible duplicate of unix.stackexchange.com/questions/16969/…
    – John B
    Commented Nov 18, 2013 at 0:02
  • Please give an example of the operation you are attempting. The solutions are probably different depending on whether you are copying to local or to remote. Commented Nov 18, 2013 at 21:32
  • @JoeAtzberger scp local remote. remote dir is sticky bitted for group and should be 664 or 775 as standard
    – exussum
    Commented Nov 18, 2013 at 22:16

4 Answers 4


You can create a separate user for scp on the remote side, and set their umask through login.conf(5) (if on OpenBSD).


AFAIK, scp does not initialize a shell, thus don't source any file such as .profile, .bashrc, /etc/profile.

So the only way of doing this seems to use the pam module pam_umask.so. But it will be applied to all users (unless you use a more complicated PAM setup)

The file /etc/pam.d/sshd is probably the best place to do it, if you want to limit this behavior to ssh sessions :

session optional pam_umask.so umask=0007
  • 1
    This was mentioned in the question, It didnt work for me. though im not sure about the umask 0007 ?
    – exussum
    Commented Jan 27, 2015 at 9:16
  • My bad… I overlooked the question. Did you try to debug the module execution? Commented Jan 27, 2015 at 11:10

I think you need to use something better to this like rsync command.

Taken from man:

Some of the additional features of rsync are:

   support for copying links, devices, owners, groups, and permissions


   Local:  rsync [OPTION...] SRC... [DEST]

   Access via remote shell:
     Pull: rsync [OPTION...] [USER@]HOST:SRC... [DEST]
     Push: rsync [OPTION...] SRC... [USER@]HOST:DEST

To preserve modification times, access times, and modes from the original file you can use -p after scp. But this is not what you are looking for.

  • 1
    I dont want to preserve information, I want to have it set as 664 instead of 644
    – exussum
    Commented Nov 19, 2013 at 17:07

what you are trying to do you can't achive with umask try to mask instead.

umask acts like this:

  • situation per default folders are created with 775 and files with 664 (owner/user read+write group read+write others read - folders also have set traverse for user group and others)

if one does not like this one can cut the roghts by e.g setting a umask like 027 wich means user no changes group -2 (default minus write) others -7 (default minus read/write/execute(traverse if folder)

to be simple: umask 027 ~= chmod g-w o-rwx

so with umask u can only lower/cut rights

to add/higher rights use mask

if you need to know more please read the man pages of umask and mask or have a look at the entry on wikipedia http://en.m.wikipedia.org/wiki/Umask

  • 1
    There is no mask command. umask is the right way to set the default mask. Besides, if you set the mask with umask 0000, new files will be created with 666 as permissions, and directories with 777. So this command does allow a higher permission than the default one. Commented Jan 26, 2015 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .