In sftp, how to set the default permission for all files in a folder?

Question

I want to set the default permission for all files in a folder, including newly uploaded ones, to a certain value, say 644, instead of doing "chmod 644" all the time.

Is there any command making this possible?

Answer 1

Alternatively, you can set the umask for all sftp logins in sshd's config file (/etc/ssh/sshd_config on my Debian box). For that add -u 022 to the sftp subsystem line like so:

Subsystem sftp /usr/lib/openssh/sftp-server -u 022

From man sftp-server:

-u umask
     Sets an explicit umask(2) to be applied to newly-created files and directo‐
     ries, instead of the user's default mask.

Answer 2

I've spent considerable time searching for a more complete answer to this question. Configuring a different umask for sftp is well and good, but it is not a universal answer, since the umask will only restrict permissions and not grant additional ones. What exact permissions a file uploaded via sftp end up with depend also on the permissions of the original source file, and on the client used for the upload.

As an example, I've set the umask on my (OpenSSH, on a Red Hat server) sftp server to 0002, but if I upload a text file with 0600 permissions on the source system using the OpenSSH sftp client, it will still have 0600 permissions at the destination. Notably this means I cannot, to the best of my knowledge, ensure that files uploaded to this sftp server have any group permissions at all, which by extension means I also cannot use access control lists (ACL) to extend permissions to other users or groups.

To attempt two methods that would address this, though in both cases they are more workarounds than solutions:

• Create a cron job to manually set the desired permissions after the fact. Simple enough but asynchronous, even though you could run it frequently.
• Use inotify to monitor the destination directories used by the sftp server, and set the desired permissions for any files created in them. This should be practically immediate, but may have other limitations, such as in the case of large numbers of files or directories.

I came upon a blog post at positon.org which nicely explains the inotify option, with examples and even init scripts. It's best read there, but in the event the site ever disappears, the key command is:

inotifywait -mrq -e CREATE --format %w%f /tmp/mytest/ | while IFS= read -r FILE; do chmod g=u "$FILE"; done

As neat as this is, I would still be very interested in a way, by feature or trickery, to obtain the same result within sftp or at least the shell, without involving separate utilities.

Answer 3

Modify /etc/ssh/sshd_config to have:

Subsystem sftp internal-sftp -m 0644

Reload SSHD configuration:

sudo systemctl reload sshd

Answer 4

The permission files are created with depends on your umask. To get 644 permissions, set your umask to 022 (umask 022).

To make this change permanent, put that command in the remote servers ~/.profile (depending on your shell).

Answer 5

The .profile will be in the home directory for your user account. When ssh in you're going to be in your home directory, but you can also cause the shell to change to your home directory by typing:

cd

If you're on linux and your user shell is bash, as most people are, you probably won't have a .profile, but you may have a .bash_profile and .bashrc. Set the umask in either of those files rather than make a .profile.