topic Re: Set umask for specific sftp users in Operating System - HP-UX

Set umask for specific sftp users

Fernando Boza — Tue, 20 Jul 2010 20:06:21 GMT

How I can Set umask for certain sftp users?

Re: Set umask for specific sftp users

Steven E. Protter — Tue, 20 Jul 2010 20:21:01 GMT

Shalom,

sftp if part of openssh respects user umask, unless overridden in sshd_config for the daemon.

It will never transfer a file as executable.

SEP

Re: Set umask for specific sftp users

Bill Hassell — Tue, 20 Jul 2010 21:59:10 GMT

Actually, sftpd (the remote side daemon) sets the umask value, similar to ftp. However, there appears to be a couple of useful options in sftpd. See man sshd_config. There are two options in the sshd_config file:

PermitUserEnvironment yes
SftpUmask 027

According to the sshd_config man page, if a local user's environment is permitted, then $HOME/.ssh/environment is read and the values are put in place. I could not get this to work with HP's sshd A.04.20.009. It appeared that the user environment was not implemented.

However, SftpUmask 027 in the sshd_config file did work as expected. As Steven said, the execute bit will never be set. However, the sshd directive is global -- all user files will have the sshd_config umask.

Since you have sftp working, you might consider using scp instead which is ideal for scripts. With scp, you can specify -p to preserve the mode on the remote side.

Re: Set umask for specific sftp users

Fernando Boza — Wed, 21 Jul 2010 14:23:44 GMT

hi Bill

which line should I put the file environment?

Re: Set umask for specific sftp users

Bill Hassell — Wed, 21 Jul 2010 14:54:49 GMT

The man pages say that you can put environment values in the file so what I did was:

echo "SftpUmask 027" > $HOME/.ssh/environment

This assumes that you are logged in as a user. Or replace $HOME with the location of the user's home directory. Be sure to set owner and permissions to: 600. But as I said, this had no effect. The SfpUmask did work in the sshd_config but sets umask for all sftp transfers.