I want to set the default permission for all files in a folder, including newly uploaded ones, to a certain value, say 644, instead of doing "chmod 644" all the time.
Is there any command making this possible?
Alternatively, you can set the umask for all sftp logins in sshd's config file (/etc/ssh/sshd_config on my Debian box). For that add -u 022
to the sftp subsystem line like so:
Subsystem sftp /usr/lib/openssh/sftp-server -u 022
From man sftp-server
:
-u umask
Sets an explicit umask(2) to be applied to newly-created files and directo‐
ries, instead of the user's default mask.
I've spent considerable time searching for a more complete answer to this question. Configuring a different umask for sftp is well and good, but it is not a universal answer, since the umask will only restrict permissions and not grant additional ones. What exact permissions a file uploaded via sftp end up with depend also on the permissions of the original source file, and on the client used for the upload.
As an example, I've set the umask on my (OpenSSH, on a Red Hat server) sftp server to 0002, but if I upload a text file with 0600 permissions on the source system using the OpenSSH sftp client, it will still have 0600 permissions at the destination. Notably this means I cannot, to the best of my knowledge, ensure that files uploaded to this sftp server have any group permissions at all, which by extension means I also cannot use access control lists (ACL) to extend permissions to other users or groups.
To attempt two methods that would address this, though in both cases they are more workarounds than solutions:
I came upon a blog post at positon.org which nicely explains the inotify option, with examples and even init scripts. It's best read there, but in the event the site ever disappears, the key command is:
inotifywait -mrq -e CREATE --format %w%f /tmp/mytest/ | while IFS= read -r FILE; do chmod g=u "$FILE"; done
As neat as this is, I would still be very interested in a way, by feature or trickery, to obtain the same result within sftp or at least the shell, without involving separate utilities.
Modify /etc/ssh/sshd_config to have:
Subsystem sftp internal-sftp -m 0644
Reload SSHD configuration:
sudo systemctl reload sshd
The permission files are created with depends on your umask
. To get 644 permissions, set your umask to 022 (umask 022
).
To make this change permanent, put that command in the remote servers ~/.profile
(depending on your shell).
umask 022
at the very bottom (in most cases).
Sep 6, 2011 at 0:29
~/.bash_profile
exists, then ~/.profile
will be ignored.)
Sep 6, 2011 at 7:39
The .profile will be in the home directory for your user account. When ssh in you're going to be in your home directory, but you can also cause the shell to change to your home directory by typing:
cd
If you're on linux and your user shell is bash, as most people are, you probably won't have a .profile, but you may have a .bash_profile and .bashrc. Set the umask in either of those files rather than make a .profile.