Posted by zdw 3 days ago
Generally, try not to use SCP. It has been a crufty old program from the Berkeley R-Utilities, but newer OpenSSH releases have rewritten it to use the sftp-server server instead. There will be wildly different behavior between these implementations.
The backend SCP changes are documented here:
https://lwn.net/Articles/835962/
If you need something that SFTP cannot do, then use tar on both sides.
PuTTY has implemented their pscp to prefer the sftp-server for many years, in a long prediction of the eventual abandonment. Their pscp implementation is a better drop-in replacement than the OpenSSH solutions.
The allure of SCP is retry on failure, which is somewhat more difficult with SFTP:
until scp source.txt user@target:dir/
do echo target down; sleep 300
done
I also have an older rhel5 system where I am running tinysshd to use better SSH crypto. Due to upgrades, NFS is now squashing everything to nobody, so I had to disable precisely these checks to let users login with their authorized_keys. I can post the code if anybody is curious.
You get the benefit of being able to e.g. get your last download off your desktop to your laptop like this:
scp -TO desktop:'downloads/*(oc[1])' .
scp -TO desktop:'$(ls -t downloads/* | head -1)' .
scp -TO desktop:'~foo/config/database.yml' config/
scp -TO desktop:'$FOO_DIR/config/database.yml' config/
for server in "${trusted_servers[@]}"; do
scp -TOr $server:'$(grep -Po '\''foo_\K\w+'\'' docker-compose.yml)' .
done
scp -TOr malicious:foo/ .
> If you need something that SFTP cannot do, then use tar on both sides.
No reason to make things inconvenient between personal, trusted computers, just because there may be malicious servers out there where one has no reason to SCP.
What makes it a better drop in replacement?
-PuTTY pscp allows raw passwords on the command line, or from a file. OpenSSH is unreasonable in refusing to do this.
-Scripting can adapt to a .netrc easily; OpenSSH will never do this.
-Modern OpenSSH is a nightmare when using legacy crypto, while pscp is fluid. There is nothing wrong with hmac-md5, and no reason to refuse it. I will take PuTTY or dropbear in a heartbeat over these burned bridges and workarounds.
https://www.openssh.org/legacy.html
-pscp does not link to dozens of libraries as ssh/scp does, so it is easier to build with less dependency. The ldd output of ssh and scp on rhel9 is 23 libraries, while PuTTY is 3 [package obtained from EPEL].
-pscp strongly leans to SFTP on the backend and can be directed to use it exclusively, so there is no ambiguity.
-Using pscp with a retry on fail is much easier than sftp -b.
-The wacky cipher control on rhel8 does not impact the PuTTY tools.
That is an extensive list.
Wouldn't tar do the exact same thing to that file's permissions?
signed -confused
I had it wrapped in stunnel TLS, but I ripped that out recently as I am retiring and the new staff is simply not capable of maintaining that configuration.
My users were yelling, and the patch to tinysshd to omit all permissions checks silenced the complaints. No, it's not pretty.
but also... who has a dir with 777 permissions? Is that something people do nowadays?
$ ll -d /tmp
drwxrwxrwt. 20 root root 4096 Mar 3 12:19 /tmp
$ mkdir mytmp
$ chmod 1777 mytmp
$ ll -d mytmp
drwxrwxrwt. 1 luser lgroup 0 Mar 3 12:19 mytmpScript all the things. double-check your scripts... always be backing up.
I would have used AutoHotkey or something similar in such a scenario.
Too many burned fingers to not do this little dance almost every other time.
Actually, I lied, I just use rsync like an insane person.