Both Debian and Ubuntu ship with pam_umask. This allows you to configure umask in /etc/login.defs
and have them apply system-wide, regardless of how a user logs in.
To enable it, you may need to add a line to /etc/pam.d/common-session
reading
session optional pam_umask.so
or it may already be enabled. Then edit /etc/login.defs
and change the UMASK
line to
UMASK 002
(the default is 022
).
Note that users may still override umask in their own ~/.profile
or ~/.bashrc
or similar, but (at least on new Debian and Ubuntu installations) there shouldn’t be any overriding of umask in /etc/profile
or /etc/bash.bashrc
. (If there are, just remove them.)