Ssh – Per-user umask over all ssh connections

I can suggest trying 2 things:

1. pam_umask
2. LD_PRELOAD wrapper (self-written?)

Many things could be going on here.

First thoughts:

• yes, pam.d changes take effect immediately
• /etc/pam.d/common-session is the best place to set a default umask
• any pam.d umask would get overridden by any entry in .bashrc,
  but .bashrc only gets read under certain circumstances (interactive, non-login shell)
• testfile (711) is very strange
  • how is /home mounted, and are you using ACLs?
    (e.g. what do ls -ld /home and getfacl /home print?)
  • did testfile already exist before you did the copy, because scp won't change the permissions on a file that already existed (unless you use the -p flag)
• Nautilus is known to create files a different way, not sure why, or what the rules are
• umask=0113 will probably cause problems
• are the server and client running the same operating system?
  for example, if the client has ACLs enabled, or is Cygwin, the behavior can be different
• the best way to force sane permissions is to use default ACLs, exactly because, as you discovered, umask can be overridden by the user in .bashrc and .bash_profile.

Update:

• umask=0113 for sshfs is wrong.
  1. Try mounting without specifying a umask
  2. Create a new file inside the mount point using touch.
  3. You should see it only gets e.g. -rw-r--r--, without x bits
  4. By masking out x bits, you might break directories
     and compilers may be unable to create executable files properly

Workaround:

If we can't think of anything better, you could either use fam or gamin to watch for new files being created and fix the permissions on them, or even just a script that runs periodically and sets the permissions on all files.