4 ms·

According to the article, there's an scp patch in the works (proposed upstream) to use the sftp protocol, it might be tested in Fedora: https://lwn.net/ml/fedor

by Aissen 6y ago

According to the article, there's an scp patch in the works (proposed upstream) to use the sftp protocol, it might be tested in Fedora: https://lwn.net/ml/fedora-devel/5c5ff586-c5af-2375-d189-b72de444aa99@redhat.com/ https://lwn.net/ml/fedora-devel/5c5ff586-c5af-2375-d189-b72d...

toyg 6y ago
> missing -3 support, it will not work if the server does not run sftp subsystem Eh. Seems like a half-assed solution for a non-problem, that will simply break stuff, remove functionality, and increase attack space for no benefit. If you need sftp, use sftp.
- shawnz 6y ago
  Isn't it decreasing attack surface if it's removing functionality? Unless you typically disable SFTP on your servers, in which case it seems like there would be basically equal attack surface after this change.
  - Aissen 6y ago
    It will indeed decrease attack surface by removing (long-term, not day one) SCP protocol support. I'm not even sure gp did read the article on the security history (and unfixed bugs!) of said protocol.
    - a1369209993 6y ago
      There is no security history[0]; you gave the client shell access and they used shell access; that's all there is to it. 0: that is specific to scp rather than ssh in general, and where the client (rather than some third party) is the attacker
      - shawnz 6y ago
        SCP also has security implications for the client though.
  - indymike 6y ago
    Actually, what will happen is that if there is lots of breakage, people will not upgrade their SSH server and client. That sounds worse than the current situation.
    - shawnz 6y ago
      Is there a reason to think there will be any breakage at all? Furthermore, the situation you are describing could only become a problem for environments where you control both the client and server (in which case, why not let them shoot themselves in the foot if they want to?)
naivedevops 6y ago
Good luck with OpenWrt routers and other embedded stuff which only have Dropbear without sftp.

by Aissen 6y ago

toyg 6y ago

> missing -3 support, it will not work if the server does not run sftp subsystem Eh. Seems like a half-assed solution for a non-problem, that will simply break stuff, remove functionality, and increase attack space for no benefit. If you need sftp, use sftp.

shawnz 6y ago
Isn't it decreasing attack surface if it's removing functionality? Unless you typically disable SFTP on your servers, in which case it seems like there would be basically equal attack surface after this change.
- Aissen 6y ago
  It will indeed decrease attack surface by removing (long-term, not day one) SCP protocol support. I'm not even sure gp did read the article on the security history (and unfixed bugs!) of said protocol.
  - a1369209993 6y ago
    There is no security history[0]; you gave the client shell access and they used shell access; that's all there is to it. 0: that is specific to scp rather than ssh in general, and where the client (rather than some third party) is the attacker
    - shawnz 6y ago
      SCP also has security implications for the client though.
- indymike 6y ago
  Actually, what will happen is that if there is lots of breakage, people will not upgrade their SSH server and client. That sounds worse than the current situation.
  - shawnz 6y ago
    Is there a reason to think there will be any breakage at all? Furthermore, the situation you are describing could only become a problem for environments where you control both the client and server (in which case, why not let them shoot themselves in the foot if they want to?)

naivedevops 6y ago

Good luck with OpenWrt routers and other embedded stuff which only have Dropbear without sftp.