I'm trying to get sftp to give me a umask of 002 but it keeps behaving like the umask is 022. How do I get it to do that?

Red Hat 7.4

/etc/ssh/sshd_config has the line:

Subsystem sftp internal-sftp -u 002

I've also tried

Subsystem sftp internal-sftp -u 0002

After each change I make to sshd_config I issue the following command:

sudo systemctl restart sshd.service

Then in a separate window I log into sftp.

Once I've uploaded the file in sftp, then "ls -Fla" in the shell session returns:

drwxrwsr-x. 2 [myID]  [myGroup]         32 Dec 28 17:37 ./
drwxrwxr-x. 4 [siteID] [siteGroup]      50 Dec 26 18:44 ../
-rw-r--r--. 1 [myID]  [myGroup]    9173334 Dec 28 17:37 [myUploadedFile]

(last line having r-- as the group permission)

where I would expect:

drwxrwsr-x. 2 [myID]  [myGroup]         32 Dec 28 17:37 ./
drwxrwxr-x. 4 [siteID] [siteGroup]      50 Dec 26 18:44 ../
-rw-rw-r--. 1 [myID]  [myGroup]    9173334 Dec 28 17:37 [myUploadedFile]

(last line having rw- as the group permission)

I've also tried

Subsystem sftp internal-sftp -u ug=rwx

but that one causes sftp to close the connection. At least it confirms that I'm updating the right configuration file.

  • Are you sure the remote umask is the problem? Your SFTP client may be setting explicit permissions on the remote file. – Kenster Dec 29 '18 at 19:09

Notice that umask values only reduce permissions, never adds them.

So if your local file was permission 0644 (-rw-r--r--) then the umask will not add a group write flag. The umask will remove "other write"; so if your local file was 0666 then the remote would be 0664.

If you want to ensure the remote file has group write then you might want the -m 664 flag instead.


In your sshd config file, try setting "ForceCommand" on your groups

Match Group {GROUP_NAME}
   ForceCommand internal-sftp -u 0002 

Restart your sshd process for the new settings to take effect

  • Do you have some reason to believe the normal subsystem configuration isn't working here? – Kenster Dec 29 '18 at 19:10

Depending on your sftp usage pattern, it might be a viable approach to change the behaviour from the client side.

If you are able to modify the permissions of the file you are 'putting' (or they are already desirable), you can use the -p parameter with put, which will copy permissions and file modify time (works with scp as well). Assuming your local file has the permissions you desire, the below should work:

put -p <filename>

Alternately, if you are receiving files, lumask is provided to set local permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.