I've figured out how to accomplish a "create-but-don't-modify" permission scheme using SFTP. But it works for files only; I'd like to expand it to directories.


I have an SFTP server (OpenSSH-based) which confines a specific user group to a common chroot jail directory. The configuration is similar to that in this conversation.

I want users in this group to be able to create files and directories but not modify or delete them once created. I can't do this directly, as standard Linux permissions do not differentiate between "write" and "modify" permissions.

I can make it work by combining the SFTP root directory permissions with the umask option in the SFTP server configuration.


drwxr-xr-x  root  root       /sftproot
drwxrwxr-x  root  sftpgroup  /sftproot/upload_directory


Subsystem sftp internal-sftp
Match Group sftponly
  ChrootDirectory /sftproot
  ForceCommand internal-sftp -d /upload_directory -u 0222

Note the -u 0222 switch. This applies a umask to newly-created files, which removes specific permissions.


When a user in the sftponly group uploads a new file, it is allowed because of the group-write directory permission. Then the umask option clears the 'w' bits, making the file non-modifiable. The file ends up looking like this:

-r--r--r--  {user}  sftponly  /sftproot/upload_directory/filename

Great! This is just what I want.


The user can also create directories, which is also what I want. But, the newly-created directories also have their 'w' bits cleared, which prevents any new files from being written within.


How can I have the SFTP-created directories remain writable but keep the files read-only?

Any clever ideas?

  • Did you happen to find any solutions for this? Sep 30, 2022 at 13:15
  • 1
    @StephanMøller No, not yet, I ran out of ideas. I keep hoping someone will come by with an answer :)
    – bitsmack
    Sep 30, 2022 at 17:22

1 Answer 1


Based on sftp-server (5) manpage, you can use the -u umask command line option to override user's umask:

     -u umask
             Sets an explicit umask(2) to be applied to newly-created files and directories, instead of
             the user's default mask.

So, just set the umask this way so that users don't have write permission anymore.

To set this, refer to sshd_config(5) manpage as mentionned in the sftp-server manpage:

     Command-line flags to sftp-server should be specified in the Subsystem declaration.  See
     sshd_config(5) for more information.
  • Thank you, but I think you misunderstand. I guess I wasn't clear! I am already using the sftp-server umask option. This is what makes it work as far as it does. But it also effects directories, which is what I want to change.
    – bitsmack
    Dec 12, 2019 at 15:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .