4 ms·

Why would you use anything other than scp?

brazzy 17y ago
Because you're still in the process of setting up an actually secure SSH in the first place? If you're serious about security, scp is not secure (open to man-in-the-middle attacks) until you've transferred keys via some other channel or use a PKI that you actually pay attention to.
- jsn 17y ago
  Say what? scp is perfectly secure (not open to man-in-the-middle attack) without transferring any keys or using any PKI. scp (just like ssh) asks you to verify remote key fingerprint on first connect.
  - mbreese 17y ago
    This only works if you know the remote key fingerprint in the first place. If you're setting up new servers, it could potentially be compromised. But that is being ultra-paranoid in my book.
    - adamtj 17y ago
      If you're setting up a new server, you either have physical access and can use a keyboard and monitor to look it up, or it's hosted by people you are paying to do such things as tell you the key fingerprint.
      - wortiz 17y ago
        Just to be clear mbreese is talking about if you have just set up a new server like a vps and when you first ssh/scp to the server you accept a compromised key such as through a MITM attack but as he said this is highly unlikely to occur.
        fragmede 17y ago
        I setup a VPS on Linode, and they actually added the SSH RSA/DSA key for the 'admin console' login (Lish) when I asked about it on IRC. So, for first-time setup, you can lookup _that_ key, then from there, lookup the system key itself. This avoids a compromised key, at least from you to Linode. Hopefully Linode doesn't have any internal gremlins. Of course, the weak point there is SSL where the keys themselves are transmitted, but it did well to quell my paranoia.
    - jsn 17y ago
      1. If you are setting up servers, you don't need to transfer private keys anyway. You may want to transfer client public key to server, but that is absolutely unrelated to man-in-the-middle, paranoia or anything. 2. If you are setting up servers, you may want to transfer the server public (not private) key to client, but what's the point? Ssh/scp will do it for you anyway, and you already know the remote end public key fingerprint anyway -- since you are setting it up. So, no, "ultra-paranoid" doesn't explain the pastes in question. "Ultra-ignorant" does :)
- vog 17y ago
  Even in that case, scp would still be a better option than pastebin.

Because you're still in the process of setting up an actually secure SSH in the first place? If you're serious about security, scp is not secure (open to man-in-the-middle attacks) until you've transferred keys via some other channel or use a PKI that you actually pay attention to.

jsn 17y ago
Say what? scp is perfectly secure (not open to man-in-the-middle attack) without transferring any keys or using any PKI. scp (just like ssh) asks you to verify remote key fingerprint on first connect.
- mbreese 17y ago
  This only works if you know the remote key fingerprint in the first place. If you're setting up new servers, it could potentially be compromised. But that is being ultra-paranoid in my book.
  - adamtj 17y ago
    If you're setting up a new server, you either have physical access and can use a keyboard and monitor to look it up, or it's hosted by people you are paying to do such things as tell you the key fingerprint.
    - wortiz 17y ago
      Just to be clear mbreese is talking about if you have just set up a new server like a vps and when you first ssh/scp to the server you accept a compromised key such as through a MITM attack but as he said this is highly unlikely to occur.
      - fragmede 17y ago
        I setup a VPS on Linode, and they actually added the SSH RSA/DSA key for the 'admin console' login (Lish) when I asked about it on IRC. So, for first-time setup, you can lookup _that_ key, then from there, lookup the system key itself. This avoids a compromised key, at least from you to Linode. Hopefully Linode doesn't have any internal gremlins. Of course, the weak point there is SSL where the keys themselves are transmitted, but it did well to quell my paranoia.
  - jsn 17y ago
    1. If you are setting up servers, you don't need to transfer private keys anyway. You may want to transfer client public key to server, but that is absolutely unrelated to man-in-the-middle, paranoia or anything. 2. If you are setting up servers, you may want to transfer the server public (not private) key to client, but what's the point? Ssh/scp will do it for you anyway, and you already know the remote end public key fingerprint anyway -- since you are setting it up. So, no, "ultra-paranoid" doesn't explain the pastes in question. "Ultra-ignorant" does :)
vog 17y ago
Even in that case, scp would still be a better option than pastebin.