sshfs-win
sshfs-win copied to clipboard
winfsp
Permissions are not set correctly when copying or creating files
When copying or creating a file from a Windows client to the mapped sshfs path, the files created or copied do not inherit the permissions set on the parent folder. Thus, the resulting error is a "permission denied" .
If the enclosing parent folder has these rights "drwxrwxrwx" , winfsp will ALWAYS give the files the following permissions: "-rwx------" . It doesn't matter if the user is a regular user or if you are authenticating as root. This is problematic. Is there a way that sshfs-win can inherit the enclosing folder's permission when it copies or creates files in the child folder ?
Do you use sshfs-win from the command line or using window's explorer?
Your problem is related to this[1] one and the solution is to pass -o umask=xyz to sshfs-win to control how files should be created on the remote system.
[1] https://stackoverflow.com/questions/28125638/setting-umask-for-sshfs-mount
@mhogomchungu Can you demonstrate how to do that?
There is apparently no way to add option via Windows' explorer;
Using sshfs-win svc \sshfs\musr@host Z: -o umask=0111 on my machine throws error "Invalid argument 'umask=0111'";
Using sshfs-win cmd user@host: Z: -o umask=0111 does work, but the connection is temporary: once disconnected the mountpoint completely disappeared.
sshfs-win seems to have additional two options to set permissions on created files/folders.
- create_file_umask=0000
- create_dir_umask=0000
The first one sets options for newly created files and the second one sets option for newly created folder.
Change those "0000" to numbers that works best for you.
sshfs-win does not take these options when used from window's explorer or net use.
You may also need to pass -o uid=-1,gid=-1 options to get permissions the way you want them.
The options will have to be passed to sshfs-win everytime it is invoked to make the connection.
its not working can you show full command line?
C:\Program Files\SSHFS-Win\bin>sshfs-win svc \sshfs\[email protected] Z: -o umask=0111
sshfs: invalid argument `umask=0111'
C:\Program Files\SSHFS-Win\bin>sshfs-win cmd \sshfs\[email protected] Z: -o umask=0111
Cannot create WinFsp-FUSE file system: invalid mount point.
C:\Program Files\SSHFS-Win\bin>sshfs-win cmd [email protected] Z: -o umask=0111
read: Connection reset by peer
C:\Program Files\SSHFS-Win\bin>sshfs-win svc \sshfs\[email protected] Z: -o uid=-1,gid=-1
sshfs: invalid argument `uid=-1,gid=-1'
C:\Program Files\SSHFS-Win\bin>sshfs-win svc \\sshfs\[email protected] Z: -o uid=-1,gid=-1
sshfs: invalid argument `uid=-1,gid=-1'
May be exists some config file in "C:\Program Files\SSHFS-Win\etc" ?
Any update on this? The only method that works for me is the explorer network location method, the direct use of sshfs-win gives the same errors as above. The additional two options are not working either. Also the manager fails with Connection reset by peer.
With explorer mounting the files can only be read and modified, no new files or folders can be created. Not very useful ;)
Please give correct command line to make the svc mount so that current user can create files and folders without problems.
This looks very promising but we need the normal permissions, obviously :)
Thanks.
Below is what i did to make files on the remote system to be created with permissions of 0755.
set PATH="C:\Program Files\SSHFS-Win\bin"
sshfs -f [email protected]:/home/ink/abc X: -o create_file_umask=0000,idmap=user
Below is what i did to make files on the remote system to be created with permissions of 0644.
set PATH="C:\Program Files\SSHFS-Win\bin"
sshfs -f [email protected]:/home/ink/abc X: -o create_file_umask=0111,idmap=user
Like i said above,"create_file_umask=XYZ" is the option to use to make remote files be created with preferred permissions.
The "set PATH" line is important because it makes sure ssh from this project is getting used if you have other ssh programs installed.
Why do you want to use sshfs-win svc?
This command (sshfs -f) gives error read: Connection reset by peer. on my machine, and no mount point is created.
The only command that works for me is the sshfs-win cmd mentioned above, but then the mount point is temporary: once disconnected (which happens a lot) the drive is completely lost.
In contrary, via "Map Network Drive" method the mount point is always there, and will try to reconnect every time you navigate in it. But there's no way to set umask.
@mhogomchungu Thank you very much, with those I get it to work, however I still have these problems:
- it asks for passphrase and then password each time I would like to use the ssh key but how to do that?
- the window stays open until the connection is closed (this is why I wanted to use svc to get it work like explorer method)
@passerbyxp I had the same problem but then I deleted (renamed just in case) the file: c:\users\username.ssh\config It was created by VSCode for key-based connection but for some reason it caused the reset by peer error :O But I still have the problems above so it is still not fully working as I want yet.
So now I will need to figure out how to use the key-based authentication with sshfs, any help is highly appreciated for that and the problems above :)
The front page mentions SiriKali and SSHFS-Win-Manager as GUI front ends to sshfs-win and both support connecting using ssh keys but currently only SiriKali allows you to set custom options for "create_file_umask" and "create_dir_umask".
Try to use them as they are more convenient compared to running commands from the terminal.
Thank you for the tip :)
I installed Sirikali and added an entry but when I try to 'unlock' it (Open), I get:
Failed To Complete The Task And Below Log was Generated By The Backend.
----------------------------------------
Bad owner or permissions on /cygdrive/c/Users/username/.ssh/config
read: Connection reset by peer
If again rename the config file, the dialog get grey and after a while I get this:
Something is wrong with the backend and it took too long to respond
Backend??????????? Sirikali is one of the most confusing programs I have seen, the UI is horrible and the terms are mixed up (key means password but key file is not ssh-key file, 'unlock' means connect etc.).
How so simple thing as file and directory permissions can be made so complicated? If sshfs used the normal permissions by default, everything would be easy and worked directly in explorer. Now just because the default permissions are so stupid, it takes days to figure out how to get those simple settings to actually work :o
If Sirikali at least had proper documentation, it might be more understandable but the FAQ did not help.
I am not newbie with Windows/network stuff but I have never seen so big mess.
So please can you still help me if you have figured out how this thing works? :)
Thank you!
Yes, "backend", SiriKali does not work with sshfs only, it works with securefs, cryfs, gocryptfs, ecryptfs-simple, fscrypt, encfs together with sshfs-win. All these programs are "backends" and SiriKali is a "GUI front end". These are standard terms.
SiriKali gives sshfs 30 seconds to connect because it can't wait forever. Sshfs-win is an odd "backend" because it deals with network connections while SiriKali is fundamentally a GUI front to backends that deals with "folder based encryption" and thats why some texts don't translate very well to it.
ssh told you it didn't like the file owner or permissions on the path "/cygdrive/c/Users/username/.ssh/config" and the solution was not to rename anything but to change the permission or owner,
Why do you get such an error? What path did you put in the "identify file path"?
Thank you for still helping me :)
Yes, "backend", SiriKali does not work with sshfs only, it works with securefs, cryfs, gocryptfs, ecryptfs-simple, fscrypt, encfs together with sshfs-win. All these programs are "backends" and SiriKali is a "GUI front end". These are standard terms.
Ok, that explains the term backend and other terms better too, now they make sense.
SiriKali gives sshfs 30 seconds to connect because it can't wait forever. Sshfs-win is an odd "backend" because it deals with network connections while SiriKali is fundamentally a GUI front to backends that deals with "folder based encryption" and thats why some texts don't translate very well to it.
Ah ok, now I got it :)
ssh told you it didn't like the file owner or permissions on the path "/cygdrive/c/Users/username/.ssh/config" and the solution was not to rename anything but to change the permission or owner,
Why do you get such an error? What path did you put in the "identify file path"?
I browsed to private key: C:/Users/username/.ssh/id_rsa
The owner of the 'config' file was Administrators :o, I changed it to my username and the permission/owner message went away but now I still get the "Something is wrong with the backend and it took too long to respond" message.
Task manager shows ssh.exe appears each time I try to open the mount: C:\Program Files\SSHFS-Win\bin\ssh.exe
So SSHFS-Win is running, why Sirikali cannot connect to it? :o
I use option 'Key' in the open dialog and give the password to my remote ssh right? On the other hand, now that I have defined the private ssh key, shouldn't it use that and not password? Did I do something wrong?
Getting closer, thank you again and please continue with me :)
Below is what i did to connect to remote system using ssh private key
set PATH="C:\Program Files\SSHFS-Win\bin"
sshfs.exe -f "[email protected]:/home/ink" "Y:" -o IdentityFile=C:/Users/Ink/Desktop/ssh/id_rsa,idmap=user
The path to the ssh private key is set with fuse option "IdentityFile". The path to the identify file should not contain a space character.
First try to connect from the terminal to make sure you can connect then go back to SiriKali.
In SiriKali the path you put as the identify file goes to the input field pointed to by arrow number 1 in the image below. Since the volume uses a private and does not use a password, check the checkbox pointed to by arrow number 2.
YES! Now it works! Thank you VERY much for your help!
Couple of questions still:
- does it matter (other than location in Computer window) if the mount is UseNetworkDrive yes or no? I like it better as network drive but is there some reason why it defaults to no?
- permissions still are not correct with default values nor the 0111,0000 :o And what does the umask=0000 mean when there are both create_file_umask=0000 and create_dir_umask=0000? With those defaults when I try to save a file on the mounted drive, I get this:
N:\permtest.txt
You don’t have permission to save in this location.
Contact the administrator to obtain permission.
Would you like to save in the Documents folder instead?
The file actually gets linux permissions 775 (-rwxrwxr-x) which is wrong for files. If I use umask 0111, the linux shows correct (644) but still I get that same error message.
You seem to use the defaults, can you create files and directories on the mounted drive? If so, please confirm the exact Mount options you use for me :)
Thank you!
sshfs-win creates network drives by default and SiriKali creates local drives by default because it didn't know better in the beginning and now its because of this bug[1]. In terms of functionality, i do not know if there is a difference between them but creating network drive seems to be a better option.
I already talk about the behavior i am seeing on the remote system based on how i change create_file_umask here[2]. It is hard to predict what options works best for everyone and i added them there with "0000" to make it easier for users of SiriKali to change them. In my tests here, umasks option did not make any difference.
Are you sure the connecting user has writing access to the folder on the remote computer?
[1] https://github.com/billziss-gh/sshfs-win/issues/125#issuecomment-555173473 [2] https://github.com/billziss-gh/sshfs-win/issues/180#issuecomment-641726310
sshfs-win creates network drives by default and SiriKali creates local drives by default because it didn't know better in the beginning and now its because of this bug[1]. In terms of functionality, i do not know if there is a difference between them but creating network drive seems to be a better option.
Ok
I already talk about the behavior i am seeing on the remote system based on how i change create_file_umask here[2]. It is hard to predict what options works best for everyone and i added them there with "0000" to make it easier for users of SiriKali to change them. In my tests here, umasks option did not make any difference.
Ok so you use the same with Sirikali, thanks for confirmation :)
Are you sure the connecting user has writing access to the folder on the remote computer?
Should be yes because it is my home directory and the files get owner correctly. Strange thing is that the files get created but Notepad++ gives that error message. After that I can still open the file again and it works normally. Also strange is that if I create new file with Windows new>text file, the file does not show up but when I do F5, there are 4 copies of it :o
When testing those permissions, I do unmount, edit, mount, is that ok or should I do something more to ensure the settings are understood by Windows? :)
Yes, unmount->edit->mount should work but its a bit cumbersome. While SiriKali has focus, press CTRL+D to get a debug window. Connect and see the exact command SiriKali is using and you can use them from the terminal. I always try things from the terminal first.
Are you sure you are running the latest versions of both sshfs and winfsp?
Ok, thanks! Yes I like terminal too but as I couldn't get the options correct, Sirikali is nice. But even better is that it can now give me the correct options so I will I'll try that!
WinFSP is 1.7.20123 (beta) which is funny as now there is only 1.6 :o SSHFS-WIN is 3.5 which is still the latest (beta)
Maybe I will try to install the WinFSP official version and perhaps also non-beta of SSHFS-WIN if they have some problems.
Thank you very much for your help :)
I uninstalled WinFSP and SSHFS-WIN and then installed the latest official versions: WinFSP 1.6.20027 SSHFS-WIN 3.5.20024
With Sirikali the mount works but if I take the command from debug window and then unmount and quit Sirikali, I get read: Connection reset by peer error :o
Any ideas why that happens?
Also with this debug info:
***************************
Backend took 2 seconds to unlock a volume
***************************
Exit Code: 0
Exit Status: 0
-------
StdOut:
-------
StdError:
-------
Command: "C:\Program Files\SSHFS-Win\\bin\sshfs.exe" -f --VolumePrefix=\mysshfs\"[email protected];/home/username" "[email protected]:/home/username" "N:" -o rw,fsname=sshfs@"[email protected]:/home/username",subtype=sshfs,create_file_umask=0000,create_dir_umask=0000,umask=0000,idmap=user,StrictHostKeyChecking=no,IdentityFile=C:/Users/username/.ssh/id_rsa,volname="username"
-------
Exit Code: 1
Exit Status: 0
-------
StdOut:
-------
StdError:
-------
Command: explorer.exe "N:"
-------
I still cannot create new files/folders. Or I can but from explorer I get 4 copies for both files and folders and e.g. Notepad++ says I cannot save to that folder. The file is actually still created (but empty) but I need to open it separately, then I can edit it.
Weird, huh? :D
Any ideas?
I now have managed to get the permissions to show up in linux correctly, with these mount options in Sirikali: create_file_umask=0111,create_dir_umask=0000,uid=-1,gid=-1,StrictHostKeyChecking=no,UseNetworkDrive=yes,IdentityFile=C:/Users/username/.ssh/id_rsa That results in 755 for dirs and 644 for files which is exactly what I want.
But still the file is not directly editable, I need to refresh the folder window and then open it again :o
So any ideas are still very welcome :)
P.S. I just realized that you @mhogomchungu are the author of the Sirikali, so I want to say my humble apology for my first reactions on Sirikali :( I thought you were some other guy who wanted to help me to understand what some other guy had meant. I still think the UI is not the most intuitive but it needs to adapt to different backends and now the terms make sense and I have no problems with it anymore, so sorry again. And BIG thanks for you that you still help me so kindly after that :o :)
With Sirikali the mount works but if I take the command from debug window and then unmount and quit Sirikali, I get read: Connection reset by peer error :o
Any ideas why that happens?
You always have to set the PATH variable before running sshfs from the terminal. It is not by accident that i always set it in my examples like i did here[1]
[1] https://github.com/billziss-gh/sshfs-win/issues/180#issuecomment-642176654
But still the file is not directly editable, I need to refresh the folder window and then open it again :o
This need to be in its own thread and this thread should now be left to rest since you have permissions set the way you wanted them.
Apology accepted. An honest opinion usually hurts and usually generates a defensive response but its usually the best opinion to receive. Its already in my to do like to create a dedicated UI for setting up sshfs volume because the current one was not designed with sshfs use cases in mind The option to create a network drive or a local drive for example should be a checkbox but a user has to edit a string because there is no room to add a checkbox in the UI.
With Sirikali the mount works but if I take the command from debug window and then unmount and quit Sirikali, I get read: Connection reset by peer error :o
Any ideas why that happens?
You always have to set the PATH variable before running sshfs from the terminal. It is not by accident that i always set it in my examples like i did here[1]
[1] #180 (comment)
But I thought using full path to the exe would take care of that, that's how all other programs usually work and isn't that also the commend Sirikali runs? Also all parameters that refer to paths are full paths. Or does it change the PATH as well so that some parts of it calls the correct ones? :o This is confusing but I will try that of course :)
But still the file is not directly editable, I need to refresh the folder window and then open it again :o
This need to be in its own thread and this thread should now be left to rest since you have permissions set the way you wanted them.
Ok, where should I open the thread? Here or WinFsp or some other? I'm still a bit confused which of those does what :) Also is FUSE in use in SSHFS-WIN/WinFsp? I've read posts around the internet and some of them are for FUSE, some for sshfs but mostly there are not much for SSHFS-WIN/WinFsp so can the ideas in them even be used for this?
Apology accepted. An honest opinion usually hurts and usually generates a defensive response but its usually the best opinion to receive. Its already in my to do like to create a dedicated UI for setting up sshfs volume because the current one was not designed with sshfs use cases in mind The option to create a network drive or a local drive for example should be a checkbox but a user has to edit a string because there is no room to add a checkbox in the UI.
Thank you, yes it is now obvious that Sirikali has to deal with very different backends and so making intuitive UI for all of them is near impossible without actually making separate one for each. That checkbox would also be nice, even though the setting is included in the mount parameters so it is easy to change from no to yes :)
But just to make sure, so when you use the mount settings you listed earlier, you can create files and directories normally in Windows and the files have correct (644/755) permissions on server side? Then that is even more weird thing, what can be different in my case? :o
Today I will be away all day (it's 8.20 am here now) so I will read your possible replies within 12 hours. Fascinating, isn't it? :D
- sshfs ships with ssh client.
- Windows 10 also ships ssh client.
- sshfs just calls ssh client and leaves it up to the system to figure out which one to use.
- Without setting the path, windows will find its ssh client and sshfs will break because it only works with its own version.
- This is a know problem and was reported a long time ago[1][2].
- SiriKali solves the problem by setting the path correctly to make sure ssh client from sshfs is the one that will always get picked.
- If you run sshfs from the terminal, you must also set the path to make sure ssh client from sshfs will be used.
ssh client that sshfs-win uses depends on FUSE API(Application Programming Interface).
WinFsp is a kernel driver that offers file system functionality and it offers it through its own API and through FUSE API.
Since the permission problem goes away after you refresh the folder, the problem is probably with WinFsp not properly propagating folder permissions to explorer.
On the server, what does command "umask" give you? Its not possible to set default options that works for everybody because different servers have different ideas on what permissions files/folders should be created with.
[1] https://github.com/billziss-gh/sshfs-win/issues/110 [2] https://github.com/billziss-gh/sshfs-win/issues/39
- sshfs ships with ssh client.
- Windows 10 also ships ssh client.
- sshfs just calls ssh client and leaves it up to the system to figure out which one to use.
- Without setting the path, windows will find its ssh client and sshfs will break because it only works with its own version.
- This is a know problem and was reported a long time ago[1][2].
- SiriKali solves the problem by setting the path correctly to make sure ssh client from sshfs is the one that will always get picked.
- If you run sshfs from the terminal, you must also set the path to make sure ssh client from sshfs will be used.
Ok, now I got it, thanks!
ssh client that sshfs-win uses depends on FUSE API(Application Programming Interface).
WinFsp is a kernel driver that offers file system functionality and it offers it through its own API and through FUSE API.
Ah, ok. Thanks again :)
Since the permission problem goes away after you refresh the folder, the problem is probably with WinFsp not properly propagating folder permissions to explorer.
Ok so I will need to ask about this in WinFsp area, thanks!
On the server, what does command "umask" give you? Its not possible to set default options that works for everybody because different servers have different ideas on what permissions files/folders should be created with.
Directly run in terminal it gives 0002. That should mean it gives 775 for dirs and 664 for files, right? Then it should be ok. Hmm...or should it?
I'm confused... I took the exact command from Sirikali debug window and added the PATH and then that command in a bat. Here is the bat:
set PATH="C:\Program Files\SSHFS-Win\bin"
sshfs.exe -f --VolumePrefix=\mysshfs\"[email protected];/home/anuoreva" "[email protected]:/home/anuoreva" "N:" -o rw,fsname=sshfs@"[email protected]:/home/anuoreva",subtype=sshfs,create_file_umask=0111,create_dir_umask=0000,umask=0000,uid=-1,gid=-1,StrictHostKeyChecking=no,IdentityFile=C:/Users/anuoreva/.ssh/id_rsa,volname="anuoreva"
But when I run that, it gives error:
Cannot create WinFsp-FUSE file system.
The service sshfs has failed to start (Status=c000000d).
How can that be? Sirikali just used that command and it worked fine :O Also it seems sshfs does not get the networkdrive option and if I use the mount options directly, it still creates local drive :o
If I remove the --Volumeprefix... part, then it works. Also with your earlier command it works. But still in both cases the problem is the same when I try to save a text file from Notepad++ (changed drive letter from above):
M:\new 5.txt
You don’t have permission to save in this location.
Contact the administrator to obtain permission.
Would you like to save in the Documents folder instead?
Does your server give different umask or what can cause that? It seems the problem must be on server side as the files get proper permissions on the server.
The Windows folder permissions to mounted drive root level are:
They look normal except that what is that None user? My username is anuoreva and for that the permissions look to be ok.
Weird :)
umask command on my server also gives me "0002".
I do not know why but i neither get the permission errors you are getting nor multiple files bug.
Ok, thanks for the info! It is indeed weird why I get that behavior but I have written to the WinFSP issues (there was already related thread, I added comment there) so let's see if there someone can figure out what is going on.
So, for now I finally stop bothering you, I might get back later if needed but anyway now for the Sirikali and SSHFS everything works otherwise so it is not showstopper anymore :)
Thank you very much for all your help and have a nice day!
is there a way to add the password to the sshfs.exe command so that i do not have to enter it manually ?
I just wanted to tell that now everything works fine :)
The reason for the weird behaviour with permissions was that all files on this computer got Administrators group as owner and that caused problems :o I wrote about this problem in WinFSP issues and after having read tons of similar but not same problems, I included fsptool-x64 id command result. And that triggered one guy to point out that it looked weird. Then I compared to my other computer which also has my account belonging to Administrators and there the owner was the user, not Admin group. Then I compared the account settings and noticed that on both computers the UAC was at lowest level BUT on this computer, for some weirdest reason it still said I need to reboot to apply it :o I did that UAC change when I installed Windows over a year ago and haven't touched that setting after that but still I had to click Ok and then reboot and now everything works!
Thank you very much for your help, it was the key to this SSHFS thing and now the permissions work perfectly as well so all is great :)
I just wanted to tell that now everything works fine :)
The reason for the weird behaviour with permissions was that all files on this computer got Administrators group as owner and that caused problems :o I wrote about this problem in WinFSP issues and after having read tons of similar but not same problems, I included fsptool-x64 id command result. And that triggered one guy to point out that it looked weird. Then I compared to my other computer which also has my account belonging to Administrators and there the owner was the user, not Admin group. Then I compared the account settings and noticed that on both computers the UAC was at lowest level BUT on this computer, for some weirdest reason it still said I need to reboot to apply it :o I did that UAC change when I installed Windows over a year ago and haven't touched that setting after that but still I had to click Ok and then reboot and now everything works!
Thank you very much for your help, it was the key to this SSHFS thing and now the permissions work perfectly as well so all is great :)
Hi Anttin, i'm basically struggling with the same issue as you.. I'm not the most technical guy so I'll try to explain this the best way I can.
I'm using SSHFS to mount my two webservers as network locations on Win 10. If i create file or folder through the SSH or through VS Code (network locations included in workspace), they get wierd permissions set so that I can't view the files through internet. However, if I create/upload through FTP client, everything is working fine.
I didn't fully understand how you managed to solve this issue, could you perhaps explain once again for me?
