4 ms·
I wonder why that's the case. shell access is way more permissive compared to the sftp subsystem. Why would and admin enable full shell access but not sftp? Wh
by pilif 6y ago
I wonder why that's the case. shell access is way more permissive compared to the sftp subsystem.
Why would and admin enable full shell access but not sftp? What does sftp allow that shell access doesn't?
Pure shell access clearly is a superset of all functionality - for example, given shell access, a poor man's scp would be
ssh user@remote "cat /path/to/target/file" < local file
and if you need to do more files at once, add `tar` to the mix.
- toyg 6y agoIt's one more protocol and one more executable (sftp-server) where things can go wrong and be exploited. Because it's less popular than the pure shell, it's likely less tested. So the right security posture, if you don't need it, is to disable it.
- pseudalopex 6y agosftp-server is linked into sshd since 2008.[1] How do you know it's less popular? It seems like every non embedded distro enables it. OpenSSH linked sftp-server into sshd because SFTP only configurations were popular. [1] https://www.openssh.com/txt/release-4.9 https://www.openssh.com/txt/release-4.9
- tkfu 6y agoIn most cases, it’s not so much a considered security posture and more that Yocto and other embedded builds tend to use dropbear instead of openssh because it’s smaller, and dropbear doesn’t support sftp.