I did some research for you.
My (local) client is Ubuntu, my (remote) server is Raspbian. I connect via SFTP using the client's sftp
interactive command. I transferred a testfile with local permissions -rwxrwxrwx
from the client to the server using this command within sftp
:
put testfile
The remote copy inherited permissions, except some of them were masked by the remote umask, which was 0022
, so the remote permissions turned out to be -rwxr-xr-x
. This is expected.
Then I edited the remote ~/.profile
to (temporarily) set umask as 0002
. After logging in again the new umask worked in the remote shell. I restarted my local sftp
and tested again but the new remote copy didn't obey the new umask.
Not a surprise. In my remote .profile
it reads:
for setting the umask for ssh logins, install and configure the libpam-umask package
It turned out libpam-umask
is in fact in libpam-modules
. It had already been installed.
I read this piece of documentation. It gives an example:
Add the following line to /etc/pam.d/login
to set the user specific umask at login:
session optional pam_umask.so umask=0022
I checked the remote /etc/pam.d
directory and guessed I need to modify sshd
file there, not login
. Additionally I didn't want to pass umask globally to the module. The documentation says:
The PAM module tries to get the umask value from the following places in the following order:
umask=
argument
umask=
entry in the user's GECOS field
- […]
I chose GECOS, run sudo vipw
and added umask=0002
to my entry; saved. The result was:
kamil:x:1001:1004:Kamil Maciorowski,,,,umask=0002:/home/kamil:/bin/bash
Then I added this line at the end of /etc/pam.d/sshd
:
session optional pam_umask.so
After this I removed the remote copy of testfile
, run local sftp
anew and transferred the testfile
again. The new remote copy obeyed my chosen umask.
Edit
I tried FileZilla on my local Ubuntu. It creates files on the server with respect to the remote umask; it copies local files with their local permissions also with respect to the remote umask.
With FileZilla one can change permissions of a remote file "by hand". I understand this is what you want to avoid.
(Edit ends here)
I think the procedure for you is as follows:
- Take the above example and set umask for the two users in question, so remote files they create via SFTP are writable by group.
- Crate a special group on the server, add the two users to it and make it their primary group.
(I won't explain point 2 in detail here. Do research; ask separate question(s) in case of problems).
This way every new file created via SFTP by any of the two users will belong to the special group and it will be writable by this group. Remember that files being copied preserve their permissions as far as they can (at least in my tests).
sshd
? or something else (e.g.dropbear
)? On what filesystem do you create new files? How is the filesystem mounted? Please edit the question and add this information there, along with any other relevant information from your comments (like a fact you're using FileZilla on Mac). The point is to let other users know everything important without them reading all the comments and picking information scattered there.