I did some research for you.
My (local) client is Ubuntu, my (remote) server is Raspbian. I connect via SFTP using the client's
sftp interactive command. I transferred a testfile with local permissions
-rwxrwxrwx from the client to the server using this command within
The remote copy inherited permissions, except some of them were masked by the remote umask, which was
0022, so the remote permissions turned out to be
-rwxr-xr-x. This is expected.
Then I edited the remote
~/.profile to (temporarily) set umask as
0002. After logging in again the new umask worked in the remote shell. I restarted my local
sftp and tested again but the new remote copy didn't obey the new umask.
Not a surprise. In my remote
.profile it reads:
for setting the umask for ssh logins, install and configure the libpam-umask package
It turned out
libpam-umask is in fact in
libpam-modules. It had already been installed.
I read this piece of documentation. It gives an example:
Add the following line to
/etc/pam.d/login to set the user specific umask at login:
session optional pam_umask.so umask=0022
I checked the remote
/etc/pam.d directory and guessed I need to modify
sshd file there, not
login. Additionally I didn't want to pass umask globally to the module. The documentation says:
The PAM module tries to get the umask value from the following places in the following order:
umask= entry in the user's GECOS field
I chose GECOS, run
sudo vipw and added
umask=0002 to my entry; saved. The result was:
Then I added this line at the end of
session optional pam_umask.so
After this I removed the remote copy of
testfile, run local
sftp anew and transferred the
testfile again. The new remote copy obeyed my chosen umask.
I tried FileZilla on my local Ubuntu. It creates files on the server with respect to the remote umask; it copies local files with their local permissions also with respect to the remote umask.
With FileZilla one can change permissions of a remote file "by hand". I understand this is what you want to avoid.
(Edit ends here)
I think the procedure for you is as follows:
- Take the above example and set umask for the two users in question, so remote files they create via SFTP are writable by group.
- Crate a special group on the server, add the two users to it and make it their primary group.
(I won't explain point 2 in detail here. Do research; ask separate question(s) in case of problems).
This way every new file created via SFTP by any of the two users will belong to the special group and it will be writable by this group. Remember that files being copied preserve their permissions as far as they can (at least in my tests).