4 ms·

Weren't we supposed to avoid scp nowadays? From https://www.openssh.com/txt/release-8.0 https://www.openssh.com/txt/release-8.0 > The scp protocol is outdated

by jabl 7y ago

Weren't we supposed to avoid scp nowadays? From https://www.openssh.com/txt/release-8.0 https://www.openssh.com/txt/release-8.0 > The scp protocol is outdated, inflexible and not readily fixed. We recommend the use of more modern protocols like sftp and rsync for file transfer instead.

snagglegaggle 7y ago
I remember reading about this also, but never really received a good explanation. Implementation-wise SCP is a lot cleaner to use especially in code. It doesn't support some things like resuming a file, but it could, and in any case it's less of a pain than SFTP. There was a recent CVE about writing to wherever the server specified but that does not necessarily reflect poorly on the protocol.
- jws 7y ago
  Anecdotally, and not necessarily protocol but current implementation on my Debian boxes… When copying a large number of small files rsync over ssh is much faster.
  - jabl 7y ago
    Modern rsync (err, 3.0+, so maybe not that modern any longer) can scan the directory tree concurrently with sending the files. (I'm not sure how it's done, presumably interleaving readdir() calls with non-blocking sendfile, allowing page cache prefetching as well as the actual sending to be done in parallel by the kernel.)
  - snagglegaggle 7y ago
    Definitely, but mostly due to compression and change tracking. The canonical replacement for scp is sftp which is to me a nonstarter, I'm either using scp in code or for single files, or rsync for a lot of files. I would use rsync everywhere, but I need to make up a good alias, it needs too many flags by default.
- jabl 7y ago
  > It doesn't support some things like resuming a file, but it could ... and if pigs could fly.. It could, but it doesn't, and openssh developers have made it quite clear they view scp as fundamentally broken and have no interest in improving it. Scripting sftp is, while doable, tedious compared to scp. Then again, rsync is scriptable as well and offers much more than scp.
enriquto 7y ago
you also have raw ssh, that works well with pipes: tar c folder | ssh server tar x
davidcollantes 7y ago
Even though `scp` might be used, SSH is using `sftp` if: `Subsystem sftp /usr/libexec/openssh/sftp-server` Is set on `sshd_config`.
- jabl 7y ago
  My understanding is that this line in sshd_config only configures the sftp server, it doesn't tell scp to use the sftp protocol under the covers.
hwj 7y ago
Another benefit of rsync is it's ability to honour the .gitignore: rsync --filter=':- .gitignore' ...
ksaj 7y ago
I wouldn't call sftp more modern. They're from the same time. One is interactive, and the other isn't. Nothing more. Nothing less. So, if you're using it to load code for net booting, scp is the obvious choice since you want to automate the retrieval of a specific file from a specific place, to a specific destination. And you don't want to have to babysit it every time. If you're copying some specific files with lots of randomish names from your livingroom entertainment server's Downloads directory to your laptop's Documents directory, sftp is your friend. One doesn't supersede the other in any way whatsoever. There are so many things wrong with the idea that rsync is more modern. Isn't rsync older by quite a bit? And since it is lacking encryption, isn't scp the more obvious tool to use? You can't use rsync the way that you use sftp. Think of it this way: * Secure direct: scp <-- encrypted * Secure interactive: sftp <-- encrypted * Insecure direct: rsync <-- clear text * Insecure interactive: ftp <-- clear text Use clear text if the network is absolutely known to be secure (good luck on that in any productive environment) and stick to scp and sftp or equivalent secure protocols. Toss ftp and rsync to the dogs and pretend you've never heard of them except in dire emergencies where significantly better tools (like scp and sftp) aren't available.
- rdtsc 7y ago
  > Insecure direct: rsync <-- clear text rsync lately, and depending how it is compiled, defaults to using ssh, so it shouldn't be clear text in that case.
- jabl 7y ago
  > I wouldn't call sftp more modern. They're from the same time. No. scp was included in Tatu Ylönens original ssh in 1995. sftp is significantly newer, e.g. openssh gained both client and server implementation with the 2.5 release in 2001, and is dependent on the ssh 2.0 protocol. > One is interactive, and the other isn't. Nothing more. Nothing less. No. They are different network protocols. And per CVE-2019-6111 mentioned in the link I provided in the previous post, the scp protocol has some questionable semantics, which is why the openssh developers are recommending people to switch to better designed protocols such as sftp or rsync. > So, if you're using it to load code for net booting, scp is the obvious choice since you want to automate the retrieval of a specific file from a specific place, to a specific destination. And you don't want to have to babysit it every time. You can automate sftp as well. Fetching files is as simple as with scp, but uploading is more tedious, but doable if, for instance, you don't have rsync available. Something like "sftp -b - user@server:/path <<< 'put filename'". > There are so many things wrong with the idea that rsync is more modern. rsync is not a fundamentally broken network protocol like scp. And as another answer mentioned, you can tunnel rsync over ssh, which nowadays even is the default if you don't specify otherwise.

by jabl 7y ago

snagglegaggle 7y ago

I remember reading about this also, but never really received a good explanation. Implementation-wise SCP is a lot cleaner to use especially in code. It doesn't support some things like resuming a file, but it could, and in any case it's less of a pain than SFTP. There was a recent CVE about writing to wherever the server specified but that does not necessarily reflect poorly on the protocol.

jws 7y ago
Anecdotally, and not necessarily protocol but current implementation on my Debian boxes… When copying a large number of small files rsync over ssh is much faster.
- jabl 7y ago
  Modern rsync (err, 3.0+, so maybe not that modern any longer) can scan the directory tree concurrently with sending the files. (I'm not sure how it's done, presumably interleaving readdir() calls with non-blocking sendfile, allowing page cache prefetching as well as the actual sending to be done in parallel by the kernel.)
- snagglegaggle 7y ago
  Definitely, but mostly due to compression and change tracking. The canonical replacement for scp is sftp which is to me a nonstarter, I'm either using scp in code or for single files, or rsync for a lot of files. I would use rsync everywhere, but I need to make up a good alias, it needs too many flags by default.
jabl 7y ago
> It doesn't support some things like resuming a file, but it could ... and if pigs could fly.. It could, but it doesn't, and openssh developers have made it quite clear they view scp as fundamentally broken and have no interest in improving it. Scripting sftp is, while doable, tedious compared to scp. Then again, rsync is scriptable as well and offers much more than scp.

enriquto 7y ago

you also have raw ssh, that works well with pipes: tar c folder | ssh server tar x

davidcollantes 7y ago

Even though `scp` might be used, SSH is using `sftp` if: `Subsystem sftp /usr/libexec/openssh/sftp-server` Is set on `sshd_config`.

jabl 7y ago
My understanding is that this line in sshd_config only configures the sftp server, it doesn't tell scp to use the sftp protocol under the covers.

hwj 7y ago

Another benefit of rsync is it's ability to honour the .gitignore: rsync --filter=':- .gitignore' ...

ksaj 7y ago

I wouldn't call sftp more modern. They're from the same time. One is interactive, and the other isn't. Nothing more. Nothing less. So, if you're using it to load code for net booting, scp is the obvious choice since you want to automate the retrieval of a specific file from a specific place, to a specific destination. And you don't want to have to babysit it every time. If you're copying some specific files with lots of randomish names from your livingroom entertainment server's Downloads directory to your laptop's Documents directory, sftp is your friend. One doesn't supersede the other in any way whatsoever. There are so many things wrong with the idea that rsync is more modern. Isn't rsync older by quite a bit? And since it is lacking encryption, isn't scp the more obvious tool to use? You can't use rsync the way that you use sftp. Think of it this way: * Secure direct: scp <-- encrypted * Secure interactive: sftp <-- encrypted * Insecure direct: rsync <-- clear text * Insecure interactive: ftp <-- clear text Use clear text if the network is absolutely known to be secure (good luck on that in any productive environment) and stick to scp and sftp or equivalent secure protocols. Toss ftp and rsync to the dogs and pretend you've never heard of them except in dire emergencies where significantly better tools (like scp and sftp) aren't available.

rdtsc 7y ago
> Insecure direct: rsync <-- clear text rsync lately, and depending how it is compiled, defaults to using ssh, so it shouldn't be clear text in that case.
jabl 7y ago
> I wouldn't call sftp more modern. They're from the same time. No. scp was included in Tatu Ylönens original ssh in 1995. sftp is significantly newer, e.g. openssh gained both client and server implementation with the 2.5 release in 2001, and is dependent on the ssh 2.0 protocol. > One is interactive, and the other isn't. Nothing more. Nothing less. No. They are different network protocols. And per CVE-2019-6111 mentioned in the link I provided in the previous post, the scp protocol has some questionable semantics, which is why the openssh developers are recommending people to switch to better designed protocols such as sftp or rsync. > So, if you're using it to load code for net booting, scp is the obvious choice since you want to automate the retrieval of a specific file from a specific place, to a specific destination. And you don't want to have to babysit it every time. You can automate sftp as well. Fetching files is as simple as with scp, but uploading is more tedious, but doable if, for instance, you don't have rsync available. Something like "sftp -b - user@server:/path <<< 'put filename'". > There are so many things wrong with the idea that rsync is more modern. rsync is not a fundamentally broken network protocol like scp. And as another answer mentioned, you can tunnel rsync over ssh, which nowadays even is the default if you don't specify otherwise.