Set umask for specific sftp users

[Fernando Boza]

How I can Set umask for certain sftp users?

[Steven E. Protter]

Shalom,

sftp if part of openssh respects user umask, unless overridden in sshd_config for the daemon.

It will never transfer a file as executable.

SEP

[Bill Hassell · Accepted solution]

Actually, sftpd (the remote side daemon) sets the umask value, similar to ftp. However, there appears to be a couple of useful options in sftpd. See man sshd_config. There are two options in the sshd_config file:

PermitUserEnvironment yes
SftpUmask 027

According to the sshd_config man page, if a local user's environment is permitted, then $HOME/.ssh/environment is read and the values are put in place. I could not get this to work with HP's sshd A.04.20.009. It appeared that the user environment was not implemented.

However, SftpUmask 027 in the sshd_config file did work as expected. As Steven said, the execute bit will never be set. However, the sshd directive is global -- all user files will have the sshd_config umask.

Since you have sftp working, you might consider using scp instead which is ideal for scripts. With scp, you can specify -p to preserve the mode on the remote side.

[Fernando Boza]

hi Bill

which line should I put the file environment?

[Bill Hassell]

The man pages say that you can put environment values in the file so what I did was:

echo "SftpUmask 027" > $HOME/.ssh/environment

This assumes that you are logged in as a user. Or replace $HOME with the location of the user's home directory. Be sure to set owner and permissions to: 600. But as I said, this had no effect. The SfpUmask did work in the sshd_config but sets umask for all sftp transfers.