Default group write for SFTP users in Mountain Lion Server

I have set up OS X Mountain Lion Server as a file server for our mac-based department. Many of us are used to having SFTP access to avoid the slowness of AFP over VPN. I am unable to find any way to get SFTP files to be created with group write permissions which obviously causes problems when someone wants to modify someone else's files. As it exists now, sftping a file results in a file being created with the correct owner and group but only 644 permissions, not 664 permissions as desired.

A few details about our setup:

- Users are all authenticated via Active Directory which the Mac server is joined to.

- The parent folder and all sub-folders are owned by the proper Active Directory group

- No ACLs are currently set.

- creating a file via the terminal as one of the users results in 664 permissions (as expected)

I have tried:

1) modifying the umask of the sftp server by adding a umask key to /System/Library/LaunchDaemons/ssh.plist

<key>umask</key>

<integer>002</integer>

I think this should be the preferred way of making this change (although I would like to understand the security implications of changing the umask for sshd rather than just the sftp subsystem). It appears that this does have some effect. I am able to further restrict the permissions by changing the umask value (e.g. setting a umask of 007 results in a file with permissions of 640 rather than the default of 644). However, even setting a umask of 000 still results in a file with permissions 644, not 664 like I'm looking to get.

2) modifying the umask by passing the umask to the sftp-server executable into /etc/sshd_config

Subsystem sftp /usr/libexec/sftp-server -u 002

No umask value seems to have any affect at all.

What am I missing here? There must be a way to get the sftp-server to allow files to be created with 664 permissions (and new directories with 775 permissions).

Thanks!

Other helpful links:

- http://support.apple.com/kb/HT2202

- http://jeff.robbins.ws/articles/setting-the-umask-for-sftp-transactions

- http://sysadmin.circularvale.com/server-config/setting-a-umask-for-chrooted-sftp -users/