Home / server / Questions / 364882
Accepted
Phanto
Asked: 2012-03-01 06:44:20 +0800 CST

Force SFTP/SCP to copy files with a remote directory's permission

  • 772

I am having a problem with SFTP and SCP where files that are copied are not inheriting the permissions of the remote parent directory. I have seen similar questions on serverfault where the umask of the SFTP/SCP session is modified, however, that does not necessarily solve my issue, as some directories will need to have different permissions than others. Thus, I do not to have a default umask set.

Thus, I want to force the copied file to have the permissions that are set by the parent directory on the remote system. Basically, I want SCP/SFTP to work the same way that cp works without the -p option. Currently SFTP/SCP is mimicking cp -p behavior.

Here is what I want to have happen:

1.) User wants to copy file foo.txt with permissions:

-rw-------. 1 user user        0 Feb 29 09:08 foo.txt

2.) User uses SCP to copy foo.txt to the server under directory /bar. /bar has permissions (setgid is set):

drwxrws---+  3 root usergroup  4096 Feb 28 12:19 bar

3.) /bar has the following facl's set:

user::rwx
group::rwx
group:usergroup:rwx
default:user::rwx
default:group::rwx
default:group:usergroup:rw-

4.) foo.txt should have the following permissions (and facl):

-rw-rw----+ 1 user usergroup     0 Feb 29 09:33 foo.txt
user::rw-
group::rwx     #effective: rw-
group:usergroup:rw-

5.) Instead, foo.txt has permissions:

-rw-------+ 1 user usergroup     0 Feb 29 09:36 foo.txt
user::rw-
group::rwx          #effective:---
group:usergroup:rw-     #effective:---

Is there an easy way to get the file obtain expected permissions above?

Also, do my facl's make sense, or are they redundant?

EDIT: Fixed post to display properly. (Serverfault's code and numbering doesn't work too well. I needed to wrap things in pre tags.)

linux permissions sftp scp access-control-list

3 Answers

  1. Best Answer

    From the man page: "When scp copies files, the destination files are created with certain file attributes. By default, the file permissions adhere to a umask on the destination host, and the modification and last access times will be the time of the copy. Alternatively, you can tell scp to duplicate the permissions and timestamps of the original files. The -p option accomplishes this."

    For example:

    sftp user@server:backup <<< $'put -rp mysoftware/mysqldump'

    Based on the info above I am not sure what you want is possible without using a cronjob to set permissions. The umask option only applies to files being created. Setgid only applies to the group. I am sure you can write a job that sets the permissions recursively but that is all I can think of that would result in what you described unless I misunderstood the question.

    • 3

  2. Pipe a cat command through ssh. This will create the file (so it inherits the permissions) and then it will fill it with the contents. For example, to put the local file foo on remoteHost and inherit the permissions set by setfacl:

    ssh user@remoteHost "/bin/cat > /pathOnRemoteServer/foo" < foo
    • 0

  3. If you have the option to use rsync, you may have some additional controls over permissions. In particular, check out text under the --perms option. Thus spake the man page:

          In summary: to give destination files (both  old  and  new)  the
      source permissions, use --perms.  To give new files the destina-
      tion-default   permissions   (while   leaving   existing   files
      unchanged),  make  sure  that  the --perms option is off and use
      --chmod=ugo=rwX (which ensures  that  all  non-masked  bits  get
      enabled).  If you'd care to make this latter behaviour easier to
      type, you could define a popt alias for it, such as putting this
      line  in  the file ~/.popt (the following defines the -Z option,
      and includes --no-g to use the default group of the  destination
      dir):

         rsync alias -Z --no-p --no-g --chmod=ugo=rwX

      You  could  then  use  this new option in a command such as this
      one:

         rsync -avZ src/ dest/
    • 0