为 sftp 帐户设置 umask？
谁能告诉我如何为单个sftp用户设置umask？值得一提的是 IBM AIX...
将 umask 002 添加到该用户的 .profile 不起作用...（目标是来自同一组的人可以访问此用户文件）。
我已经看到了编辑 sftpd 配置的方法，尽管我只想为一个用户设置它，所以我希望找到不需要 root 访问权限的东西。
谢谢！
f.
Could anyone tell me how to set the umaskfor a single sftp user? Worth mentioning is a IBM AIX...
Adding umask 002 to that user's .profile didn't work... (the goal is that this user files are accesible to people from the same group).
I've seen somehowto's around editing the sftpd configs, though I want to set it for one user only, so I expected to find something that didn't need root access.
thanks!
f.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
对我来说效果很好。但是，需要进行一些研究，因为您提供的是文档的摘录。在我的例子中，一个具体的例子是在 /etc/ssh/sshd_config 的末尾放置两连续行在
我的例子中，如果有人在组“www”中，我想要做的是将 umask 设置为“002”（十进制 2） -data' 登录。
还有一个使用 env 的选项。变量 SSH_ORIGINAL_COMMAND 而不是“internal-sftp”，但我没有时间去追求这个。
Worked great for me. However, needed a bit of research because what you provided is an extract from docs. A specific example in my case would be to put two consecutive lines at the end of /etc/ssh/sshd_config
In my case what I wanted to do is to set umask to '002' (2 in decimal) if someone in group 'www-data' logs in.
There is also an option to use env. variable SSH_ORIGINAL_COMMAND instead of 'internal-sftp', but I did not have time to pursue that.
用户可以在客户端（每个连接）或服务器（每个公钥）上自行设置，无需 root 参与。
从客户端，我们可以使用
-s选项覆盖用于处理 sftp 交互的远程命令：（如果您的
sftp-server未安装在以下位置之一上面提到的，也将其添加到路径中）。从服务器上，我们可以在使用特定公钥建立连接时强制运行特定命令。这将为所有连接运行，而不仅仅是 SFTP 的连接，但我们可以检查 $SSH_ORIGINAL_COMMAND 环境变量来决定采取什么操作。将类似以下内容添加到
authorized_keys中可能足以满足您的需求：（替换您最喜欢的 shell 来处理任何交互式登录，并注意，如果您使用
tcsh您'我必须修改它以适应该 shell 的语法）。The user can set this up themselves without the involvement of root, either from the client (per connection) or on the server (per public key).
From the client, we can override the remote command used to handle the sftp interaction using the
-soption:(If your
sftp-serveris not installed in one of the locations mentioned above, add that to the path also).From the server, we can force a particular command to be run whenever a connection is made using a particular public key. This will get run for all connections, not just those for SFTP, but we can inspect the
$SSH_ORIGINAL_COMMANDenvironment variable to decide what course of action to take. Adding something like the following toauthorized_keysis probably sufficient for your needs:(substituting whichever is your favourite shell to handle any interactive logins, and noting that if you use
tcshyou'll have to modify this to suit that shell's syntax).我不了解 AIX，但您应该能够使用 OpenSSH 执行此操作，尽管它需要 root 权限。您需要为 sftp 的服务器组件编写一个包装器脚本。包装器需要有选择地更改用户的
umask，然后execsftp 服务器。对于选择用户，我偏向于：如果您要创建像
/usr/local/sbin/sftp-wrapper这样的脚本，那么您将在/usr/local/sbin/sftp-wrapper中更改 sftp 子系统的配置code>/etc/ssh/sshd_config from:to:
除了编写包装器脚本之外，每一步都需要 root 权限。
评论：我相信当您通过 sftp 连接时，sftp 服务器是由 root 启动的。因此，默认 umask 源自 root 的 umask。我不相信有一种方法可以从特定用户的配置中更改此设置。如果要更改所有用户的 sftp umask，可以对 sftp 子系统配置进行更简单的修改：
I don't know about AIX, but you should be able to do this with OpenSSH, though it will require root permissions. You'll need to write a wrapper script for the server component of sftp. The wrapper will need to selectively change the
umaskfor the user and thenexecthe sftp server. For selecting a user, I'm partial to:If you were to create such a script as
/usr/local/sbin/sftp-wrapper, you would then change the configuration for the sftp subsystem in/etc/ssh/sshd_configfrom:to:
Beyond writing the wrapper script, every step will require root permissions.
Comment: I believe the sftp server is started by root when you connect via sftp. Thus, the default umask derives from root's umask. I don't believe there is a way of altering this for a particular user from within that user's configuration. If you want to change the sftp umask for all users, you can make a simpler modification to the sftp subsystem configuration:
八进制的 umask 111 将产生十进制的 73，我们
将在本例中使用。
在文件末尾添加以下两行来配置sftp
一组用户的 umask。
或者，在文件末尾添加以下两行，为单个用户配置 sftp umask。
重新启动 sshd 守护进程。
这会有所帮助：Aamod chandra
A umask of 111 in Octal will yield 73 in decimal, which we
will use in this example.
Add the following two lines at the end of the file to configure the sftp
umask for a group of users.
Or, add the following two lines at the end of the file to configure the sftp umask for a single user.
Restart the sshd daemon.
this will help : Aamod chandra
我不知道为什么下面的行对我不起作用：
*Match Group
At Last add '-u 0002' for Subsystem 在 SUSE 11.3 上工作正常：
现在指定的用户只能使用公钥登录：
I don't know why below lines do not work for me:
*Match Group
At last add '-u 0002' for Subsystem works fine on SUSE 11.3:
and now specifiled user can only login with public key: