0

I created a webserver and have two users that can login over SFTP to change, edit, view, and create folders/new files. When the two users create a new file, the permissions are -rw-r--r--. I need the permissions to allow writing from the other user as well, which they can't right now. I have tried changing the umask, sshd-config file, group permissions, etc, but I still cannot figure out how to fix this. Any help will be greatly appreciated. Thanks!

The webserver is running Raspbian on a Raspberry Pi. I installed Apache, PHP, MySQL, and PHPmyAdmin. I am connecting to the pi via SFTP from filezilla on a Mac.

  • "I have tried changing the umask, sshd-config file,…" – What exactly have you tried? – Kamil Maciorowski Oct 19 '18 at 23:18
  • I changed the umask to 000 and added the line "ForceCommand sftp-Internal -u 2" to the sshd-config – JPinkstone Oct 20 '18 at 0:32
  • Yes, I am sure it is SFTP as I am connecting over port 22, and I am using filezilla on a Mac. Thanks – JPinkstone Oct 20 '18 at 3:39
  • I used FileZilla on Ubuntu. Confirmed, it can create files. But for me it creates files with respect to the remote umask. What is the OS on your server? Is there sshd? or something else (e.g. dropbear)? On what filesystem do you create new files? How is the filesystem mounted? Please edit the question and add this information there, along with any other relevant information from your comments (like a fact you're using FileZilla on Mac). The point is to let other users know everything important without them reading all the comments and picking information scattered there. – Kamil Maciorowski Oct 20 '18 at 11:01
3

I did some research for you.

My (local) client is Ubuntu, my (remote) server is Raspbian. I connect via SFTP using the client's sftp interactive command. I transferred a testfile with local permissions -rwxrwxrwx from the client to the server using this command within sftp:

put testfile

The remote copy inherited permissions, except some of them were masked by the remote umask, which was 0022, so the remote permissions turned out to be -rwxr-xr-x. This is expected.

Then I edited the remote ~/.profile to (temporarily) set umask as 0002. After logging in again the new umask worked in the remote shell. I restarted my local sftp and tested again but the new remote copy didn't obey the new umask.

Not a surprise. In my remote .profile it reads:

for setting the umask for ssh logins, install and configure the libpam-umask package

It turned out libpam-umask is in fact in libpam-modules. It had already been installed.

I read this piece of documentation. It gives an example:

Add the following line to /etc/pam.d/login to set the user specific umask at login:

session optional pam_umask.so umask=0022

I checked the remote /etc/pam.d directory and guessed I need to modify sshd file there, not login. Additionally I didn't want to pass umask globally to the module. The documentation says:

The PAM module tries to get the umask value from the following places in the following order:

  • umask= argument
  • umask= entry in the user's GECOS field
  • […]

I chose GECOS, run sudo vipw and added umask=0002 to my entry; saved. The result was:

kamil:x:1001:1004:Kamil Maciorowski,,,,umask=0002:/home/kamil:/bin/bash

Then I added this line at the end of /etc/pam.d/sshd:

session optional pam_umask.so

After this I removed the remote copy of testfile, run local sftp anew and transferred the testfile again. The new remote copy obeyed my chosen umask.


Edit

I tried FileZilla on my local Ubuntu. It creates files on the server with respect to the remote umask; it copies local files with their local permissions also with respect to the remote umask.

With FileZilla one can change permissions of a remote file "by hand". I understand this is what you want to avoid.

(Edit ends here)


I think the procedure for you is as follows:

  1. Take the above example and set umask for the two users in question, so remote files they create via SFTP are writable by group.
  2. Crate a special group on the server, add the two users to it and make it their primary group.

(I won't explain point 2 in detail here. Do research; ask separate question(s) in case of problems).

This way every new file created via SFTP by any of the two users will belong to the special group and it will be writable by this group. Remember that files being copied preserve their permissions as far as they can (at least in my tests).

  • Thanks so much for your response! I really appreciate it. So I tried everything you said, but it seems to still give the users the default permissions. My user 'webuser' I changed to "webuser:x:1001:1001:,,,,umask=0000:/var/www/html/:/bin/bash" and added the line at the end of the sshd file. I am creating a file on filezilla on the raspberry pi server and the permissions for that file are -rw-r--r--. Do you have any ideas what I am still doing wrong? Thanks again. – JPinkstone Oct 20 '18 at 1:42
  • In filezilla I can create a folder or file on the webserver. It creates an actual file in the html folder for the apache server. I can make a test1.html file on the server. I have been able to create new files through filezilla with other webservers. Thanks again for your help. – JPinkstone Oct 20 '18 at 3:38
0

I don't think filezilla does anything else than creating the file with the default permissions as specified on the remote server.

If you could change to using the OpenSSH SFTP client and server, you may use put with the -P flag.

This creates the file, which always gets the normal permissions for the remote server. But after the upload is complete, the client further asks the server to explicitly (re)set the permissions to be the same as the local file via a chmod request, for which the umask does not apply.

For more information see this answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.