1

Have a wierd issue with permissions on files uploaded to a remote system.

Locally, the file index2.html is chmod 664:

acoder@acoder-local ~ $ ll index2.html
-rw-rw-r-- 1 acoder acoder    29 May 17 14:46 index2.html

After uploading this same file to the remote system, the permissions on the remote directory show:

-rw-r--r--. 1 acoder acoder 3657 May 17 14:43 index2.html

I first thought I had incorrect umask setting on the remote system, but...

[acoder@remote public_html]$ umask
0002

For comparison, if I touch a file on the remote system, the correct permissions (for the given umask) show:

-rw-rw-r--. 1 acoder acoder    0 May 17 14:44 index3.html

So, how are permissions set on files uploaded via sftp? Why is umask ignored when placing files over sftp?

4
  • What umask are you specifying with the -u option of the server? Does it support -u?
    – ajeh
    May 17, 2018 at 21:35
  • I don't follow. Are you saying I should pass a separate umask with the sftp options?
    – a coder
    May 18, 2018 at 2:49
  • Where is your umask set? In the shell startup files? I can't remember if sftp is started through the shell on the server, but even if it is, it's a non-interactive shell, and your shell probably doesn't read the usual startup files in that case. So any changes to umask there won't be visible to the sftp server
    – ilkkachu
    May 18, 2018 at 6:09
  • 2
    @ilkkachu SFTP does not go through the login shell at all (unlike anything else using SSH). May 18, 2018 at 11:41

2 Answers 2

3

SFTP does not go through a login shell at all. It's directly managed by the SSH server. If the umask you expect is set by /etc/profile, ~/.profile, ~/.bashrc or some other shell initialization file then it doesn't apply to SFTP.

You can set an umask through the PAM module pam_umask. The setting for the SSH server will apply to both SSH shell sessions (unless overridden by a shell initialization file) and SFTP sessions.

You can also set the umask for SSH specifically by editing the Subsystem sftp line of /etc/sshd_config to pass the -u option to sftp-server.

3
  • I tried changing /etc/login.defs UMASK value to 002, but no luck - same permissions as before (detailed in question).
    – a coder
    May 18, 2018 at 14:00
  • Also tried editing /etc/ssh/sshd_config with Subsystem sftp internal-sftp -u 0022, restarted sshd service, still same permissions issue.
    – a coder
    May 18, 2018 at 14:06
  • @acoder did you resolve this finally?
    – osullic
    Jul 21, 2020 at 0:11
0

To do this through PAM, as suggested by Gilles, all that should be necessary is adding the desired umask to the user's entry in /etc/passwd like so:

usermod -c ,,,,umask=002 acoder

Although this method replaces the whole GECOS field. So any potential existing information should be included in the above command as well.

This should work if the pam_umask module is used. Which it appears to be by default on Fedora and CentOS Stream 9 (/etc/pam.d/postlogin).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .