4 ms·
How does using rsync instead of scp help? Isn't the default behavior of rsync to use SSH for transport, just like ssh does? Thus you'd still rely on forwarding
by sciurus 7y ago
How does using rsync instead of scp help? Isn't the default behavior of rsync to use SSH for transport, just like ssh does? Thus you'd still rely on forwarding keys or another ssh authentication method.
- Arathorn 7y agoThe suggestion is to use rsync rather than scp, not ssh (which as you rightly say is the default transport for rsync). SCP is a protocol layered on SSH, and has had a spate of security flaws recently: * Incorrect validation of the SCP client directory name (CVE-2018-20685) * The SCP client did not receive the validation of the name of the received object (CVE-2019-6111) * Counterfeit client SCP through object name (CVE-2019-6109) * SCP Client spoofing using stderr (CVE-2019-6110) And as of 8.0, OpenSSH recommends you no longer use SCP in favour of sftp or rsync, as per the security paragraph of https://www.openssh.com/txt/release-8.0 https://www.openssh.com/txt/release-8.0: > The scp protocol is outdated, inflexible and not readily fixed. We recommend the use of more modern protocols like sftp and rsync for file transfer instead.
- cyphar 7y agoNot to mention that rsync is a much better tool than scp in almost all respects (the only advantage scp has is that it works on all OpenSSH servers, while rsync requires you to have rsync installed on the remote end).
- sciurus 7y agoAh, I wasn't familiar with the security problems in the SCP protocol. Thanks. I had misread the recommendation on the blog post as " SSH agent forwarding is insecure, so use rsync instead of SCP", which didn't make sense.