3 ms·
It turns out, though, that in some situations, especially those where there is little or no trust between the two ends of the connection, the actual level of se
by dec0dedab0de 6y ago
It turns out, though, that in some situations, especially those where there is little or no trust between the two ends of the connection, the actual level of security may be less than expected.
So maybe we just need to educate people that giving someone scp access is the same thing as giving them ssh access? not that many people even use SCP to begin with, maybe a warning in the config file if someone tries to only enable scp without ssh. Why would you even do that?
- banthar 6y agoThe problem with scp is that the trust also needs to go the other way. There is a lot of ways ssh server can trick the client into doing bad things on your local machine.
- dec0dedab0de 6y agoThat's not mentioned in the article, do you know if it is worse than just normal ssh?
- banthar 6y agoFirst issue mentioned: CVE-2019-6111 is an example of such attack.