4 ms·

Frankly, I had not realized scp and sftp were two distinct protocols, despite my heavily using them. I thought sftp was an interactive client, while scp was mea

Frankly, I had not realized scp and sftp were two distinct protocols, despite my heavily using them. I thought sftp was an interactive client, while scp was meant for scripting, and never really bothered to dig further. I now will, thank you. However, I expect plenty of people to be in the same case.

simias 8y ago
I was definitely in the same boat. I guess I'll just progressively phase out my use of scp in favor of rsync.
djmdjm 8y ago
actually, sftp is a bit more scriptable than scp. You can pass sftp a "batchfile" of commands and control per-command whether their success should terminate the batch. scp wins on brevity of commandline syntax
- throwaway2048 8y ago
  The script-ability of sftp is pretty awkward, it doesen't conform to how virtually every other tool works in terms of "command + args" in a shell scripting context, instead you need to pass it commands through a pipeline, don't love it. Would be nice to be able to just type sftp user@domain:/file and have it do the right thing.
  - MayeulC 8y ago
    Oh, that means you have to open a pipe to the process if you want to control it from another programming language? That would be a bit harder to leverage for automation (though I guess it's just a matter of writing a few helper functions, or you could always use bash and redirections if the language is ill-suited to pipes).
  - LinuxBender 8y ago
    Add lftp on top of sftp and you get extensive scriptability. Working public anonymous demo: [1] [1] - https://tinyvpn.org/sftp/#lftp https://tinyvpn.org/sftp/#lftp
pletnes 8y ago
Some servers, and some clients, only support one of them. I’ve run into servers without sftp and subsequently stopped using it, as scp always works. Also rsync does not exist on windows, for instance git bash has only scp AFAIK.
- 0xfeba 8y ago
  A while ago I tried making windows' remote differential compression COM library work in a CLI utility like rsync. https://docs.microsoft.com/en-us/previous-versions/windows/desktop/rdc/remote-differential-compression https://docs.microsoft.com/en-us/previous-versions/windows/d...
- LinuxBender 8y ago
  You can install cygwin on windows. This will provide sftp, rsync and lftp which is awesome for doing rsync-like transfers on sftp-only chroot setups.
pushpop 8y ago
I’ve been using Linux and UNIX systems professionally for ~20 years and this is the first time I realised they were distinct protocols too.
kbenson 8y ago
Don't forget some of your other options, such as piping across ssh commands, which is specifically very useful when piping tar output[1]. Piping tar commands traditionally was useful because it dealt better with some file types than scp did (devices, sockets, named pipes, tar is better overall at dealing with them, or was in the past). The other benefit is that after you realize you're just putting a sequence of commands into place to be run remotely, you start realizing you can do other things prior to the tar command if you need... Rsync's ssh support is generally good, so might be about equivalent, but it's not always handy. 1: https://www.cyberciti.biz/faq/howto-use-tar-command-through-network-over-ssh-session/ https://www.cyberciti.biz/faq/howto-use-tar-command-through-...
chasil 8y ago
I have actually been able to separate the external sftp-server from sshd, and connect it instead to stunnel. The sftp client binary can also be instructed to use something other than the ssh client to establish connectivity. A simpler invocation could run it through (unencrypted) inetd/socket activation. SELINUX really throws fits of hysteria when running this, however. $ cat sftp-tls.sh #!/bin/sh exec nc --ssl server 52345 $ sftp -S ./sftp-tls.sh bogus Connected to bogus. sftp> cd /nobody sftp> get sftp-tls Fetching /nobody/sftp-tls to sftp-tls /nobody/sftp-tls 100% 15 8.9KB/s 00:00 sftp> quit # cat /etc/stunnel/sftp-ssl.conf #GLOBAL#### ;sslVersion = TLSv1.2 TIMEOUTidle = 6000 renegotiation = no FIPS = no options = NO_SSLv2 options = NO_SSLv3 options = SINGLE_DH_USE options = SINGLE_ECDH_USE options = CIPHER_SERVER_PREFERENCE syslog = yes debug = debug setuid = nobody setgid = nobody # chroot = /var/empty/stunnel libwrap = no service = sftp-ssl ; cd /var/empty; mkdir -p stunnel/etc; cd stunnel/etc; ; echo 'sftp-ssl: ALL EXCEPT localhost' >> hosts.deny; ; chcon -t stunnel_etc_t hosts.deny ; https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ ciphers=ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:RSA+AESGCM:!aNULL:!MD5:!DSS curve = secp521r1 #CREDENTIALS#### # verify = 4 cert = /etc/stunnel/sftp-ssl.pem #ROLE#### exec = /usr/libexec/openssh/sftp-server # execargs= sftp-server -d /home/nobody # execargs= sftp-server -l DEBUG3

simias 8y ago

I was definitely in the same boat. I guess I'll just progressively phase out my use of scp in favor of rsync.

djmdjm 8y ago

actually, sftp is a bit more scriptable than scp. You can pass sftp a "batchfile" of commands and control per-command whether their success should terminate the batch. scp wins on brevity of commandline syntax

throwaway2048 8y ago
The script-ability of sftp is pretty awkward, it doesen't conform to how virtually every other tool works in terms of "command + args" in a shell scripting context, instead you need to pass it commands through a pipeline, don't love it. Would be nice to be able to just type sftp user@domain:/file and have it do the right thing.
- MayeulC 8y ago
  Oh, that means you have to open a pipe to the process if you want to control it from another programming language? That would be a bit harder to leverage for automation (though I guess it's just a matter of writing a few helper functions, or you could always use bash and redirections if the language is ill-suited to pipes).
- LinuxBender 8y ago
  Add lftp on top of sftp and you get extensive scriptability. Working public anonymous demo: [1] [1] - https://tinyvpn.org/sftp/#lftp https://tinyvpn.org/sftp/#lftp

pletnes 8y ago

Some servers, and some clients, only support one of them. I’ve run into servers without sftp and subsequently stopped using it, as scp always works. Also rsync does not exist on windows, for instance git bash has only scp AFAIK.

0xfeba 8y ago
A while ago I tried making windows' remote differential compression COM library work in a CLI utility like rsync. https://docs.microsoft.com/en-us/previous-versions/windows/desktop/rdc/remote-differential-compression https://docs.microsoft.com/en-us/previous-versions/windows/d...
LinuxBender 8y ago
You can install cygwin on windows. This will provide sftp, rsync and lftp which is awesome for doing rsync-like transfers on sftp-only chroot setups.

pushpop 8y ago

I’ve been using Linux and UNIX systems professionally for ~20 years and this is the first time I realised they were distinct protocols too.

kbenson 8y ago

Don't forget some of your other options, such as piping across ssh commands, which is specifically very useful when piping tar output[1]. Piping tar commands traditionally was useful because it dealt better with some file types than scp did (devices, sockets, named pipes, tar is better overall at dealing with them, or was in the past). The other benefit is that after you realize you're just putting a sequence of commands into place to be run remotely, you start realizing you can do other things prior to the tar command if you need... Rsync's ssh support is generally good, so might be about equivalent, but it's not always handy. 1: https://www.cyberciti.biz/faq/howto-use-tar-command-through-network-over-ssh-session/ https://www.cyberciti.biz/faq/howto-use-tar-command-through-...

chasil 8y ago

I have actually been able to separate the external sftp-server from sshd, and connect it instead to stunnel. The sftp client binary can also be instructed to use something other than the ssh client to establish connectivity. A simpler invocation could run it through (unencrypted) inetd/socket activation. SELINUX really throws fits of hysteria when running this, however. $ cat sftp-tls.sh #!/bin/sh exec nc --ssl server 52345 $ sftp -S ./sftp-tls.sh bogus Connected to bogus. sftp> cd /nobody sftp> get sftp-tls Fetching /nobody/sftp-tls to sftp-tls /nobody/sftp-tls 100% 15 8.9KB/s 00:00 sftp> quit # cat /etc/stunnel/sftp-ssl.conf #GLOBAL#### ;sslVersion = TLSv1.2 TIMEOUTidle = 6000 renegotiation = no FIPS = no options = NO_SSLv2 options = NO_SSLv3 options = SINGLE_DH_USE options = SINGLE_ECDH_USE options = CIPHER_SERVER_PREFERENCE syslog = yes debug = debug setuid = nobody setgid = nobody # chroot = /var/empty/stunnel libwrap = no service = sftp-ssl ; cd /var/empty; mkdir -p stunnel/etc; cd stunnel/etc; ; echo 'sftp-ssl: ALL EXCEPT localhost' >> hosts.deny; ; chcon -t stunnel_etc_t hosts.deny ; https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ ciphers=ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:RSA+AESGCM:!aNULL:!MD5:!DSS curve = secp521r1 #CREDENTIALS#### # verify = 4 cert = /etc/stunnel/sftp-ssl.pem #ROLE#### exec = /usr/libexec/openssh/sftp-server # execargs= sftp-server -d /home/nobody # execargs= sftp-server -l DEBUG3