How to control permissions for files uploaded through SFTP by FileZilla

Many things could be going on here.

First thoughts:

• yes, pam.d changes take effect immediately
• /etc/pam.d/common-session is the best place to set a default umask
• any pam.d umask would get overridden by any entry in .bashrc,
  but .bashrc only gets read under certain circumstances (interactive, non-login shell)
• testfile (711) is very strange
  • how is /home mounted, and are you using ACLs?
    (e.g. what do ls -ld /home and getfacl /home print?)
  • did testfile already exist before you did the copy, because scp won't change the permissions on a file that already existed (unless you use the -p flag)
• Nautilus is known to create files a different way, not sure why, or what the rules are
• umask=0113 will probably cause problems
• are the server and client running the same operating system?
  for example, if the client has ACLs enabled, or is Cygwin, the behavior can be different
• the best way to force sane permissions is to use default ACLs, exactly because, as you discovered, umask can be overridden by the user in .bashrc and .bash_profile.

Update:

• umask=0113 for sshfs is wrong.
  1. Try mounting without specifying a umask
  2. Create a new file inside the mount point using touch.
  3. You should see it only gets e.g. -rw-r--r--, without x bits
  4. By masking out x bits, you might break directories
     and compilers may be unable to create executable files properly

Workaround:

If we can't think of anything better, you could either use fam or gamin to watch for new files being created and fix the permissions on them, or even just a script that runs periodically and sets the permissions on all files.

If an SFTP client does not specify permissions for uploaded files, the OpenSSH SFTP server assigns 0664 permissions to newly created files. That's for the default umask 0002, which you can change using the -u switch as the answer by @JimB shows.

If an SFTP client specifies the permissions, OpenSSH server uses the specified permissions (the umask does not apply).

Overview of some popular SFTP clients:

• PSFTP: Does not allow you to set permissions for uploaded files. (But Unix version preserves files of source local file)

• OpenSSH sftp: Does not allow you to set permissions for uploaded files. Preserves files of source local file. For details on the -P switch, see Does OpenSSH SFTP server use umask or preserve client side permissions after put command (chrooted environment)?

• WinSCP: You can set permissions for uploaded files

  See https://winscp.net/eng/docs/ui_transfer_custom

  

  (I'm the author of WinSCP)

• FileZilla: Does not allow you to set permissions for uploaded files. Server's default (umask) applies.