Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSet permissions when the FTP server creates an object, rather than repairing every upload afterward. Configure the daemon’s creation mode and umask, then make the upload directory’s owner, group, setgid bit and (when necessary) default ACL match the people or services that must use the files. In vsftpd, the central settings are file_open_mode, local_umask and anon_umask. In ProFTPD, use Umask, optionally supplying different masks for files and directories.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
A secure starting point is a file mode of 0640 and a directory mode of 0750 for local uploads, with collaboration provided through a group or ACL instead of 777. Test both a file and a directory after changing the configuration, because ownership, parent-directory traversal, ACLs and post-upload hooks can all affect the result.
As an Amazon Associate I earn from qualifying purchases.
How Linux calculates an FTP upload’s mode
An FTP daemon asks the kernel to create a file or directory with a requested mode. Linux then removes every permission bit present in the process umask. The usual base mode for a regular file is 0666; the usual base for a directory is 0777. Execute bits are not requested for ordinary uploaded files, so a file umask cannot be used to add executability.
The Linux umask(2) documentation illustrates the operation as 0666 & ~0022 = 0644. The same idea gives these common results:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
| Object | Requested base | Umask | Result | Meaning |
|---|---|---|---|---|
| Regular file | 0666 |
0022 |
0644 |
Owner read/write; group and others read |
| Directory | 0777 |
0022 |
0755 |
Owner full access; group and others read/search |
| Regular file | 0666 |
0027 |
0640 |
Owner read/write; group read |
| Directory | 0777 |
0027 |
0750 |
Owner full access; group read/search |
| Regular file | 0666 |
0077 |
0600 |
Owner read/write only |
| Directory | 0777 |
0077 |
0700 |
Owner access only |
These are creation-time calculations, not guarantees that the visible mode will always match. A parent directory with a default POSIX ACL can replace the normal umask calculation. A daemon, upload hook or later administrator action can also change the object after creation.
Choose the access model before choosing a mask
Write down who should be able to read, modify and delete uploads. “Everyone who can log in” is usually too broad, especially for an Internet-facing server. A mask controls permission bits; it does not decide which Unix account owns a file or which group receives it.
- Private per-user uploads: use a restrictive mask such as
0077and keep each account in its own directory. - Team uploads: use a dedicated Unix group, make the directory group-owned, set its setgid bit, and choose a mask that gives the group the required read or write access.
- Drop-only intake: allow the uploader to create files while limiting what other accounts can read. Separate the incoming directory from any directory where files are processed.
- Different readers and writers: use a default ACL for the exact accounts or groups. Do not make the whole directory world-writable.
- Anonymous uploads: isolate them from local-user homes and treat ownership and retrieval as a separate policy.
Remember that a user needs search (x) permission on every parent directory in the path. A correctly created file can still appear inaccessible when one parent directory denies traversal.
Configure vsftpd
Place the settings in the active vsftpd configuration, commonly /etc/vsftpd.conf. Confirm that the daemon is actually reading that file on your distribution; a service unit or command-line option can select a different path.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Local-user uploads
# Regular files request 0666; local_umask removes group/other write and other read bits.
file_open_mode=0666
local_umask=0027
# Do not let FTP users change modes unless there is a documented need.
chmod_enable=NOWith file_open_mode=0666 and local_umask=0027, a local-user file normally starts at 0640. A directory created under the same umask normally starts at 0750. Verify both rather than assuming that a client’s “make directory” operation uses exactly the same path or account as a file upload.
Anonymous uploads
# Anonymous sessions have their own mask.
anon_umask=0077local_umask does not control anonymous sessions. If anonymous uploads are enabled, set anon_umask explicitly and test with an anonymous connection as well as a named local account. Keep anonymous uploads in a directory that is not a local user’s home or a directory used for privileged processing.
Anonymous ownership and forced mode
vsftpd also documents chown_uploads, chown_username and chown_upload_mode for transferring ownership of anonymous uploads to a specified account and forcing an upload mode. Use these only when the resulting account and mode are part of a deliberate workflow. A forced mode can undermine the least-privilege calculation above, so inspect the final owner and mode after an anonymous test.
Apply and test the change
- Back up the active configuration and edit the directives. Keep octal values with their leading zeroes.
- Validate the configuration using the service manager or distribution tooling before restarting the daemon.
- Reload or restart the service with your distribution’s service manager, for example
systemctl restart vsftpdwhen a systemd unit is provided. Use the unit name and reload behavior supplied by your distribution. - Upload a uniquely named file as a local account and create a directory in the same session.
- Repeat the test through the anonymous branch if it is enabled.
- Inspect mode, owner and group on the server; do not rely on the FTP client’s display.
Do not set file_open_mode=0777 to obtain broad access. That requests execute bits for regular files and creates an unsafe baseline. Use group inheritance or ACLs for collaboration instead.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Configure ProFTPD
In ProFTPD, the Umask directive accepts an octal file mask and an optional directory mask. Put it in the context that governs the session: the server configuration, <Global>, a <VirtualHost>, an <Anonymous> block or a directory scope, depending on which users need the policy.
One mask for files and directories
Umask 0027ProFTPD’s normal base modes are 0666 for files and 0777 for directories. With 0027, the expected results are 0640 and 0750. The published ProFTPD calculation expresses the same rule as 0644 = 0666 - 0022 and 0755 = 0777 - 0022.
Free tools Windows power users keep installed
One-click scans. No signup required.
Different policies for files and directories
# File mask first, directory mask second
Umask 0027 0027Supplying both values makes the distinction explicit. For example, Umask 0077 0027 would normally produce private files (0600) while allowing the owning group to read and search newly created directories only when the directory ownership and group membership support that design. Calculate the result before deploying it and verify with a real upload.
Executable uploads and SITE CHMOD
ProFTPD does not normally create uploaded files with execute bits enabled. If an executable upload is an intentional requirement, handle it in a tightly controlled post-upload process or authorize SITE CHMOD narrowly. ProFTPD documents restricting that command with a <Limit SITE_CHMOD> policy. Do not grant unrestricted mode changes merely to fix an incorrectly designed upload directory.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Apply and test the change
- Place
Umaskin the scope that covers the intended account type; a setting inside<Anonymous>does not automatically govern local users. - Run the ProFTPD configuration test supplied by your installation before restarting.
- Reload or restart ProFTPD using the service manager used by the operating system.
- Upload a file and create a directory as every relevant account type.
- Check the resulting mode, owner, group and parent-directory traversal permissions on the server.
Make ownership and group inheritance work
Changing a mode does not change ownership. Linux assigns the new file’s owner to the account that creates it. The group is selected according to filesystem and parent-directory rules, including the setgid bit and mount behavior. ProFTPD does not bypass normal Unix filesystem permissions; the effective FTP account must be able to traverse and write the upload directory.
Create a shared group directory
The following is a pattern; substitute your actual service account, group and path.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
groupadd ftp-content
usermod -a -G ftp-content uploader1
usermod -a -G ftp-content processor
mkdir -p /srv/ftp/incoming
chown ftp-service:ftp-content /srv/ftp/incoming
chmod 2770 /srv/ftp/incomingThe leading 2 in 2770 sets the directory’s setgid bit. New files and subdirectories inherit ftp-content as their group instead of relying on the creator’s primary group. The setgid bit does not grant access by itself: the inherited group still needs suitable mode bits, and every user must be a member of that group.
Use a less permissive directory mode, such as 2750, when group members only need to read and search. Give group write access only where the workflow requires it. Deletion is controlled primarily by the parent directory’s write and search permissions, not by the uploaded file’s mode alone.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Add a default ACL when group bits are not enough
When several named users or groups need different rights, a default ACL on the parent directory can express that policy. A typical design first checks ACL support and then applies an access ACL and a matching default ACL:
setfacl -m g:ftp-content:rwx /srv/ftp/incoming
setfacl -d -m u::rwx,g::rwx,g:ftp-content:rwx,m::rwx,o::--- /srv/ftp/incomingReview the effective mask shown by getfacl /srv/ftp/incoming. The default ACL can supersede the ordinary umask calculation, so the daemon’s numeric mask alone may not predict the final mode. Keep the ACL as narrow as the application allows and document which service accounts depend on it.
Verify the result on Linux
Run tests using the same account and protocol branch that production will use. Record the daemon, configuration scope and account before interpreting a discrepancy.
- Upload a uniquely named regular file.
- Create a uniquely named directory through FTP.
- Inspect the objects with:
stat -c '%A %a %U %G %n' /srv/ftp/incoming/test-file stat -c '%A %a %U %G %n' /srv/ftp/incoming/test-directory - Inspect every component of the path with:
namei -l /srv/ftp/incoming/test-file - Check ACLs when the mode is unexpected:
getfacl /srv/ftp/incoming/test-file getfacl /srv/ftp/incoming - Compare the owner and group with the account that should process or retrieve the upload.
- Remove test objects only after recording the result and any relevant service-log entries.
chmod changes permission bits after creation, and chown changes ownership. They are useful for a deliberate migration or repair, but neither replaces a correct daemon umask and directory design.
Troubleshoot unexpected 600, 640, 644 or 777 results
The file is 600 instead of 640
- Check whether the session was anonymous and therefore used
anon_umaskrather thanlocal_umask. - Check for a default ACL on the parent; it can replace the normal umask calculation.
- Confirm that the active configuration contains the setting you edited and that the daemon was reloaded or restarted.
- Look for a post-upload hook, scanner or processing service that ran
chmodafter creation.
The file is 644 when you expected 640
- Verify that the effective umask is really
0027, not0022, in the applicable daemon context. - Check for a broader default ACL or an external process resetting modes.
- Confirm that you measured a newly created file, not an older object left from before the configuration change.
The directory is not group-writable
- Remember that file and directory masks can be separate in ProFTPD; inspect both values.
- Check the directory’s group ownership and whether the intended users are members of that group.
- Check the setgid bit and the mode of every parent directory with
namei -l. - If named users need different rights, use a default ACL rather than making the directory world-writable.
FTP can create a file but cannot read or delete it
- Creation requires write and search permission on the parent; reading the file additionally requires file read permission.
- Deletion generally depends on write and search permission on the containing directory, plus any sticky-bit policy.
- Inspect the resulting owner and group. An anonymous-upload ownership rule may have assigned the file to a service account that the FTP user cannot read.
- Check chroot or virtual-root paths and the real filesystem path shown by server logs.
Security rules for automatic permissions
- Use the narrowest mask that supports the workflow. Treat
0022as a deliberate choice, not a universal default. - Keep anonymous uploads isolated and prevent uploaded regular files from being executable by default.
- Use Unix groups, setgid directories and default ACLs for collaboration instead of
chmod 777. - Restrict
SITE CHMODunless users genuinely need to alter modes, and limit it to the smallest account or directory scope. - Use filesystem permissions as the serious access-control boundary; FTP configuration alone cannot compensate for an overly permissive path.
- Review upload and chroot-related settings as security-sensitive, especially when accounts can write data that another service will execute or process.
Which configuration approach fits your case?
| Requirement | Primary control | Additional design |
|---|---|---|
| Private local-user files | vsftpd local_umask=0077 or ProFTPD Umask 0077 |
Separate home or upload directories |
| Local users share read-only files | File mask such as 0027 |
Shared group, setgid parent, group read permission |
| Local users share read/write files | Mask chosen for group write | Dedicated group, setgid directory and carefully controlled deletion rights |
| Anonymous intake | vsftpd anon_umask and optional anonymous ownership controls |
Isolated directory and non-privileged processing account |
| Several named groups need different rights | Daemon umask for the baseline | Parent default ACL and regular getfacl review |
| Files must become executable | Not a normal umask function | Controlled post-upload process or narrowly limited SITE CHMOD |
The shortest reliable recipe is therefore: calculate the desired file and directory modes, set the FTP daemon’s file and directory masks, make the upload directory group-owned with setgid when sharing is required, add a default ACL only for a specific need, and verify owner, group, mode and traversal permissions with a real upload.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
