SFTP Server: Force Two Different Umask Values on Different Directories

SFTP Server: Force Two Different Umask Values on Different Directories

If you are using an SFTP server and want to have different umask values for different directories, this article will guide you through the process. Umask is a permission mask that determines the default permissions for newly created files and directories. By default, the umask value is set globally for the entire server, but with a little configuration, you can enforce different umask values on specific directories.

To achieve this, you will need to modify the server's configuration file. The specific steps may vary depending on the SFTP server software you are using, but the general concept remains the same.

Here are the steps to force two different umask values on different directories:

1. Locate the configuration file for your SFTP server. This file is usually named something like sshd_config or sftp-server.conf.
2. Open the configuration file using a text editor.
3. Search for a section that defines the settings for the SFTP server.
4. Within that section, look for a line that starts with Subsystem sftp. This line specifies the command that is executed when an SFTP session is initiated.
5. Add the -u option followed by the desired umask value to the end of the line. For example, if you want to set a umask value of 022, the line would look like this: Subsystem sftp /usr/lib/openssh/sftp-server -u 022.
6. Save the configuration file and exit the text editor.
7. Restart the SFTP server for the changes to take effect. The specific command to restart the server may vary depending on your operating system. For example, on Linux, you can use the command sudo service ssh restart.

Now that you have set a global umask value for the entire server, you can proceed to set different umask values for specific directories.

Here's how to enforce different umask values on specific directories:

1. Identify the directories for which you want to set different umask values.
2. For each directory, create a new configuration block in the SFTP server's configuration file.
3. Within each configuration block, specify the ForceCommand directive followed by the desired umask value. For example, if you want to set a umask value of 077 for a directory called /sensitive, the configuration block would look like this:

   Match User your_username
         ForceCommand /bin/sh -c 'umask 077; /usr/lib/openssh/sftp-server'

4. Save the configuration file and exit the text editor.
5. Restart the SFTP server for the changes to take effect.

That's it! You have successfully enforced different umask values on different directories in your SFTP server. Now, newly created files and directories in the specified directories will have the desired permissions according to the umask values you have set.

References