How do I configure ProFTPD as a SFTP-only server with system users, PK auth, and custom umasks?
<p>So, I managed to configure ProFTPD to allow password login for system users. I have two issues: <strong>umask</strong> and <strong>pk auth</strong>.</p>

<pre><code>Include /etc/proftpd/modules.conf

UseIPv6             on
ServerName          "Debian"
ServerType          standalone
MultilineRFC2228    on
DefaultServer       on
Port                21
PassivePorts        49152 49407
MaxInstances        30
SystemLog           /var/log/proftpd/proftpd.log

&lt;IfModule mod_ctrls.c&gt;
    ControlsEngine      off
    ControlsMaxClients  2
    ControlsLog         /var/log/proftpd/controls.log
    ControlsInterval    5
    ControlsSocket      /var/run/proftpd/proftpd.sock
&lt;/IfModule&gt;

&lt;IfModule mod_ctrls_admin.c&gt;
    AdminControlsEngine off
&lt;/IfModule&gt;

&lt;Global&gt;
    UseFtpUsers         on
    IdentLookups        off
    DeferWelcome        off
    ShowSymlinks        on
    TimeoutNoTransfer   600
    TimeoutStalled      600
    TimeoutIdle         1200
    DisplayLogin        welcome.msg
    DisplayChdir        .message true
    ListOptions         "-l"
    DenyFilter          \*.*/
    DefaultRoot         ~
    RequireValidShell   off
    User                proftpd
    Group               nogroup
    Umask               007 007
    AllowOverwrite      on
    # AuthOrder           mod_sql.c
    CreateHome          on
    TransferLog         /var/log/proftpd/xferlog

    &lt;IfModule mod_quotatab.c&gt;
        QuotaEngine off
    &lt;/IfModule&gt;

    &lt;IfModule mod_ratio.c&gt;
        Ratios off
    &lt;/IfModule&gt;

    &lt;IfModule mod_delay.c&gt;
        DelayEngine on
    &lt;/IfModule&gt;

    &lt;IfModule mod_xfer.c&gt;
        MaxStoreFileSize    70 Mb
        HiddenStores        on
        DeleteAbortedStores on
    &lt;/IfModule mod_xfer.c&gt;

    &lt;Directory /htdocs/*/&gt;
        Umask 0007
        &lt;Limit MKD XMKD RMD XRMD SITE_CHMOD&gt;
            DenyUser !ftpadmin
        &lt;/Limit&gt;
    &lt;/Directory&gt;
&lt;/Global&gt;

Include /etc/proftpd/sftp.conf
</code></pre>

<p>and <code>sftp.conf</code> is as follows</p>

<pre><code>&lt;IfModule mod_sftp.c&gt;
    &lt;VirtualHost $(hostname)&gt;
        Port 23
        SFTPEngine on
        SFTPAuthorizedUserKeys file:/home/%u/.ssh/authorized_keys
        SFTPHostKey /etc/ssh/ssh_host_dsa_key
        SFTPHostKey /etc/ssh/ssh_host_rsa_key
        SFTPHostKey /etc/ssh/ssh_host_ecdsa_key
        SFTPCompression delayed
        SFTPLog /var/log/proftpd/sftp.log
    &lt;/VirtualHost&gt;
&lt;/IfModule mod_sftp.c&gt;
</code></pre>

<p><strong>[umask]</strong> However, when a user logs in and <code>put</code>s a file, the uploaded file takes the permissions that it had originally (I'm testing using OS X and Linux as clients, so that makes sense). I have not tested the pure FTP solution, but I'd rather provide SFTP.</p>

<p><strong>[pk auth]</strong> When I attempt a PK authentication, the client correctly offers the right key, and says</p>

<pre><code>debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 535
debug2: input_userauth_pk_ok: fp SHA256:Eft1LIOozSylL20lfMc9gUdl3gKtd0zEdeyNtCb1p8Q
</code></pre>

<p>but then concludes with</p>

<pre><code>debug1: Authentications that can continue: password
</code></pre>

<p>which confuses me to no end. On the server side, I have</p>

<pre><code>no account for user 'sftpuser' found
sending userauth failure; remaining userauth methods: password
</code></pre>

<p>which is funny because the user does indeed exist (and can successfully perform a password login). I even converted my OpenSSH key to the RFC4716 format that ProFTPD appears to prefer.</p>

<p>I admit I have a grand total of about 4 hours of experience with ProFTPD, but I've been reading all I could, and the config files make sense to me. This all is running in a Docker container. What am I missing?</p>