diff -Nur ssh.4.50/hpoptions.h ssh.4.50.SockUMask_patch/hpoptions.h
--- ssh.4.50/hpoptions.h	2007-07-09 17:03:01 +0800
+++ ssh.4.50.SockUMask_patch/hpoptions.h	2007-07-09 17:01:47 +0800
@@ -125,6 +125,10 @@
 /* For 64bit compilation */
 #define HP_64BIT 1
 
+/*  Socket File UMASK Patch */
+/* Add by qxiao, 2007.07.04 */
+#define HP_SOCK_UMASK_PATCH     1
+
 /*############################################
 #       HP-UX 11.31IPF Specific Values        #
 ############################################*/
diff -Nur ssh.4.50/readconf.c ssh.4.50.SockUMask_patch/readconf.c
--- ssh.4.50/readconf.c	2007-07-09 16:52:14 +0800
+++ ssh.4.50.SockUMask_patch/readconf.c	2007-07-09 16:21:06 +0800
@@ -138,6 +138,9 @@
         oNoneEnabled, oTcpRcvBufPoll, oTcpRcvBuf, oNoneSwitch, oHPNDisabled,
         oHPNBufferSize,
 #endif /* HP_HPN_PATCH */
+#ifdef HP_SOCK_UMASK_PATCH
+        oSockUMask,
+#endif /* HP_SOCK_UMASK_PATCH */
 	oDeprecated, oUnsupported
 } OpCodes;
 
@@ -248,6 +251,9 @@
         { "hpndisabled", oHPNDisabled },
         { "hpnbuffersize", oHPNBufferSize },
 #endif /* HP_HPN_PATCH */
+#ifdef HP_SOCK_UMASK_PATCH
+        { "sockUMask", oSockUMask },
+#endif /* HP_SOCK_UMASK_PATCH */
 	{ NULL, oBadOption }
 };
 
@@ -971,6 +977,12 @@
 		intptr = &options->permit_local_command;
 		goto parse_flag;
 
+#ifdef HP_SOCK_UMASK_PATCH
+	case oSockUMask:
+		charptr = &options->sock_umask;
+		goto parse_string;
+#endif /* HP_SOCK_UMASK_PATCH */
+
 	case oDeprecated:
 		debug("%s line %d: Deprecated option \"%s\"",
 		    filename, linenum, keyword);
@@ -1132,6 +1144,9 @@
         options->tcp_rcv_buf_poll = -1;
         options->tcp_rcv_buf = -1;
 #endif /* HP_HPN_PATCH */
+#ifdef HP_SOCK_UMASK_PATCH
+	options->sock_umask = NULL;
+#endif /* HP_SOCK_UMASK_PATCH */
 }
 
 /*
@@ -1299,6 +1314,10 @@
 	/* options->hostname will be set in the main program if appropriate */
 	/* options->host_key_alias should not be set by default */
 	/* options->preferred_authentications will be set in ssh */
+#ifdef HP_SOCK_UMASK_PATCH
+	if (options->sock_umask == 0)
+                options->sock_umask = 0077;
+#endif /* HP_SOCK_UMASK_PATCH */
 }
 
 /*
diff -Nur ssh.4.50/readconf.h ssh.4.50.SockUMask_patch/readconf.h
--- ssh.4.50/readconf.h	2007-07-09 16:52:19 +0800
+++ ssh.4.50.SockUMask_patch/readconf.h	2007-07-09 16:20:07 +0800
@@ -133,6 +133,9 @@
 
 	char	*local_command;
 	int	permit_local_command;
+#ifdef HP_SOCK_UMASK_PATCH
+	char   	*sock_umask;	/* socket Umask */
+#endif /* HP_SOCK_UMASK_PATCH */
 
 }       Options;
 
diff -Nur ssh.4.50/servconf.c ssh.4.50.SockUMask_patch/servconf.c
--- ssh.4.50/servconf.c	2007-07-09 16:50:50 +0800
+++ ssh.4.50.SockUMask_patch/servconf.c	2007-07-09 16:21:26 +0800
@@ -143,6 +143,9 @@
         options->hpn_disabled = -1;
         options->hpn_buffer_size = -1;
 #endif /* HP_HPN_PATCH */
+#ifdef HP_SOCK_UMASK_PATCH
+	memset(options->sock_umask, 0, SOCK_UMASK_LENGTH);
+#endif /* HP_SOCK_UMASK_PATCH */
 }
 
 void
@@ -358,6 +361,12 @@
 	}
 #endif
 
+#ifdef HP_SOCK_UMASK_PATCH
+        /* Don't set socket umask */
+        if (!options->sock_umask)
+                memset(options->sock_umask, 0, SOCK_UMASK_LENGTH);
+#endif /* HP_SOCK_UMASK_PATCH */
+
 }
 
 /* Keyword tokens. */
@@ -421,6 +430,9 @@
         sSftpUmask,
         sSftpPermitChown, sSftpPermitChmod,
 #endif /* HP_SFTP_UMASK_FIX */
+#ifdef HP_SOCK_UMASK_PATCH
+        sSockUmask,
+#endif /* HP_SOCK_UMASK_PATCH */
 	sDeprecated, sUnsupported
 } ServerOpCodes;
 
@@ -565,6 +577,9 @@
         { "sftppermitchmod", sSftpPermitChmod},
         { "sftppermitchown", sSftpPermitChown},
 #endif /* HP_SFTP_UMASK_FIX */
+#ifdef HP_SOCK_UMASK_PATCH
+        { "sockumask", sSockUmask},
+#endif /* HP_SOCK_UMASK_PATCH */
 	{ "permittunnel", sPermitTunnel, SSHCFG_GLOBAL },
  	{ "match", sMatch, SSHCFG_ALL },
 	{ "permitopen", sPermitOpen, SSHCFG_ALL },
@@ -805,6 +820,10 @@
 	u_short port;
 	u_int i, flags = 0;
 	size_t len;
+#ifdef HP_SOCK_UMASK_PATCH
+        unsigned int sockumaskvalue = 0;
+        char *sockumaskptr;
+#endif /* HP_SOCK_UMASK_PATCH */
 
 	cp = line;
 	if ((arg = strdelim(&cp)) == NULL)
@@ -1670,6 +1689,25 @@
 		    arg = strdelim(&cp);
 		break;
 
+#ifdef HP_SOCK_UMASK_PATCH
+	case sSockUmask:
+                arg = strdelim(&cp);
+		sockumaskptr = arg;
+                while (*arg && *arg >= '0' && *arg <= '9')
+                    sockumaskvalue = sockumaskvalue * 8 + *arg++ - '0';
+                if (*arg || sockumaskvalue > 0777)
+                    fatal("%s line %d: bad value for sockumask",
+    			filename, linenum);
+		else {
+			while (*sockumaskptr && *sockumaskptr == '0')
+				*sockumaskptr++;
+			strncpy(options->sock_umask, sockumaskptr,
+				SOCK_UMASK_LENGTH);
+		}
+
+                break;
+#endif /* HP_SOCK_UMASK_PATCH */
+
 	default:
 		fatal("%s line %d: Missing handler for opcode %s (%d)",
 		    filename, linenum, arg, opcode);
diff -Nur ssh.4.50/servconf.h ssh.4.50.SockUMask_patch/servconf.h
--- ssh.4.50/servconf.h	2007-07-09 16:51:44 +0800
+++ ssh.4.50.SockUMask_patch/servconf.h	2007-07-09 16:20:24 +0800
@@ -49,6 +49,11 @@
 
 #define DEFAULT_AUTH_FAIL_MAX	6	/* Default for MaxAuthTries */
 
+#ifdef HP_SOCK_UMASK_PATCH
+/* sshd socket umask control */
+#define SOCK_UMASK_LENGTH      5
+#endif /* HP_SOCK_UMASK_PATCH */
+
 typedef struct {
 	u_int num_ports;
 	u_int ports_from_cmdline;
@@ -227,6 +232,9 @@
 	int	permit_tun;
 
 	int	num_permitted_opens;
+#ifdef HP_SOCK_UMASK_PATCH
+	char   	sock_umask[SOCK_UMASK_LENGTH];	/* socket Umask */
+#endif /* HP_SOCK_UMASK_PATCH */
 }       ServerOptions;
 
 void	 initialize_server_options(ServerOptions *);
diff -Nur ssh.4.50/session.c ssh.4.50.SockUMask_patch/session.c
--- ssh.4.50/session.c	2007-07-09 16:51:56 +0800
+++ ssh.4.50.SockUMask_patch/session.c	2007-07-09 16:21:48 +0800
@@ -175,6 +175,11 @@
 	Channel *nc;
 	int sock;
 	struct sockaddr_un sunaddr;
+#ifdef HP_SOCK_UMASK_PATCH
+        mode_t sock_umask;
+        char* psock_umask;
+        unsigned int val = 0;
+#endif
 
 	if (auth_sock_name != NULL) {
 		error("authentication forwarding requested twice.");
@@ -216,6 +221,25 @@
 	if (bind(sock, (struct sockaddr *)&sunaddr, sizeof(sunaddr)) < 0)
 		packet_disconnect("bind: %.100s", strerror(errno));
 
+#ifdef HP_SOCK_UMASK_PATCH
+        if ( (psock_umask = options.sock_umask) != NULL )
+        {
+                while (*psock_umask && *psock_umask >= '0' && *psock_umask <= '9')
+                val = val * 8 + *psock_umask++ - '0';
+
+                if (*psock_umask || val > 0777 || val == 0) {
+                        logit("bad value %o for SOCK_UMASK, using default value.", val);
+                        sock_umask = 0077;
+                } else {
+                        logit("sock umask control is on.");
+                        sock_umask = val;
+                };
+        } else sock_umask = 0077;
+
+        if(chmod(auth_sock_name, 0777 - sock_umask) == -1)
+                logit("apply sock umask failed.");
+#endif /* HP_SOCK_UMASK_PATCH */
+
 	/* Restore the privileged uid. */
 	restore_uid();
 
diff -Nur ssh.4.50/ssh-agent.1 ssh.4.50.SockUMask_patch/ssh-agent.1
--- ssh.4.50/ssh-agent.1	2007-07-09 17:12:24 +0800
+++ ssh.4.50.SockUMask_patch/ssh-agent.1	2007-07-09 17:15:38 +0800
@@ -11,6 +11,7 @@
 [\fB\-c\fP | \fB\-s\fP]
 [\fB\-t\fP \fIlife\fP]
 [\fB\-d\fP]
+[\fB\-m\fP \fIsock_umask\fP]
 [\fIcommand\fP [\fIargs\fP...]
 .br
 \fBssh-agent\fP
@@ -147,6 +148,10 @@
 
 The agent exits automatically when the command given on the command
 line terminates.
+.TP
+\fB\-m\fP
+Set the umask value for the unix-domain socket created by ssh-agent.
+The default value 0077 will be used in case the option is not specified.
 .SH FILES
 .TP
 .B ~/.ssh/identity
diff -Nur ssh.4.50/ssh-agent.c ssh.4.50.SockUMask_patch/ssh-agent.c
--- ssh.4.50/ssh-agent.c	2007-07-09 16:51:30 +0800
+++ ssh.4.50.SockUMask_patch/ssh-agent.c	2007-07-09 16:20:45 +0800
@@ -1012,6 +1012,9 @@
 	fprintf(stderr, "  -d          Debug mode.\n");
 	fprintf(stderr, "  -a socket   Bind agent socket to given name.\n");
 	fprintf(stderr, "  -t life     Default identity lifetime (seconds).\n");
+#ifdef HP_SOCK_UMASK_PATCH
+	fprintf(stderr, "  -m umask    Specify socket umask.\n");
+#endif /* HP_SOCK_UMASK_PATCH */
 	exit(1);
 }
 
@@ -1032,6 +1035,11 @@
 	extern char *optarg;
 	pid_t pid;
 	char pidstrbuf[1 + 3 * sizeof pid];
+#ifdef HP_SOCK_UMASK_PATCH
+	mode_t sock_umask;
+        char* psock_umask;
+        unsigned int val = 0;
+#endif /* HP_SOCK_UMASK_PATCH */
 
 	/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
 	sanitise_stdfd();
@@ -1051,7 +1059,7 @@
 	init_rng();
 	seed_rng();
 
-	while ((ch = getopt(ac, av, "cdksa:t:")) != -1) {
+	while ((ch = getopt(ac, av, "cdksa:t:m:")) != -1) {
 		switch (ch) {
 		case 'c':
 			if (s_flag)
@@ -1080,6 +1088,11 @@
 				usage();
 			}
 			break;
+#ifdef HP_SOCK_UMASK_PATCH
+		case 'm':
+			psock_umask = optarg;
+			break;
+#endif /* HP_SOCK_UMASK_PATCH */
 		default:
 			usage();
 		}
@@ -1160,6 +1173,26 @@
 		cleanup_exit(1);
 	}
 	umask(prev_mask);
+
+#ifdef HP_SOCK_UMASK_PATCH
+        if ( psock_umask != NULL )
+        {
+                while (*psock_umask && *psock_umask >= '0' && *psock_umask <= '9')
+                val = val * 8 + *psock_umask++ - '0';
+
+                if (*psock_umask || val > 0777 || val == 0) {
+                        logit("bad value %o for SOCK_UMASK, using default value.", val);
+                        sock_umask = 0077;
+                } else {
+                        logit("sock umask control is on.");
+                        sock_umask = val;
+                };
+        } else sock_umask = 0077;
+
+        if(chmod(socket_name, 0777 - sock_umask) == -1)
+                logit("apply sock umask failed.");
+#endif /* HP_SOCK_UMASK_PATCH */
+
 	if (listen(sock, SSH_LISTEN_BACKLOG) < 0) {
 		perror("listen");
 		cleanup_exit(1);
diff -Nur ssh.4.50/ssh.c ssh.4.50.SockUMask_patch/ssh.c
--- ssh.4.50/ssh.c	2007-07-09 16:51:36 +0800
+++ ssh.4.50.SockUMask_patch/ssh.c	2007-07-09 16:22:06 +0800
@@ -1124,6 +1124,12 @@
 	mode_t old_umask;
 	int addr_len;
 
+#ifdef HP_SOCK_UMASK_PATCH
+	mode_t sock_umask;
+	char* psock_umask;
+	unsigned int val = 0;
+#endif
+
 	if (options.control_path == NULL ||
 	    options.control_master == SSHCTL_MASTER_NO)
 		return;
@@ -1153,6 +1159,25 @@
 	}
 	umask(old_umask);
 
+#ifdef HP_SOCK_UMASK_PATCH
+	if ( (psock_umask = options.sock_umask) != NULL )
+	{
+		while (*psock_umask && *psock_umask >= '0' && *psock_umask <= '9')
+		val = val * 8 + *psock_umask++ - '0';
+
+		if (*psock_umask || val > 0777 || val == 0) {
+			logit("bad value %o for SOCK_UMASK, using default value.", val);
+			sock_umask = 0077;
+		} else {
+			logit("sock umask control is on.");
+			sock_umask = val;
+		};
+	} else sock_umask = 0077;
+
+	if(chmod(options.control_path, 0777 - sock_umask) == -1)
+		logit("apply sock umask failed.");
+#endif /* HP_SOCK_UMASK_PATCH */
+
 	if (listen(control_fd, 64) == -1)
 		fatal("%s listen(): %s", __func__, strerror(errno));
 
diff -Nur ssh.4.50/ssh_config.5 ssh.4.50.SockUMask_patch/ssh_config.5
--- ssh.4.50/ssh_config.5	2007-07-09 17:12:49 +0800
+++ ssh.4.50.SockUMask_patch/ssh_config.5	2007-07-09 17:16:03 +0800
@@ -904,6 +904,11 @@
 private RSA key.
 By default, no device is specified and smartcard support is not activated.
 .TP
+\fBSockUMask\fP
+Set the umask value for the unix-domain socket created by 
+\fBssh\fP(1)
+The default value 0077 will be used in case the option is not specified.
+.TP
 \fBStrictHostKeyChecking\fP
 If this flag is set to
 ``yes'',
diff -Nur ssh.4.50/sshd_config.5 ssh.4.50.SockUMask_patch/sshd_config.5
--- ssh.4.50/sshd_config.5	2007-07-09 17:13:01 +0800
+++ ssh.4.50.SockUMask_patch/sshd_config.5	2007-07-09 17:16:16 +0800
@@ -714,6 +714,11 @@
 Defines the number of bits in the ephemeral protocol version 1 server key.
 The minimum value is 512, and the default is 768.
 .TP
+\fBSockUMask\fP
+Set the umask value for the unix-domain socket created by
+\fBsshd\fP(8)
+The default value 0077 will be used in case the option is not specified.
+.TP
 \fBStrictModes\fP
 Specifies whether
 \fBsshd\fP(8)