scp USERNAME@SERVER:/tmp/FILE ./ USERNAME@SERVER's password: Could not chdir to home directory /home/USERNAME: No such file or directory protocol error: mtime.sec not present
scp -r .../...
OpenSSH 8.3 May 2020
scp(1): when receiving files, scp(1) could be become desynchronised if a
utimes (2) system call failed. This could allow file contents to be interpreted as file metadata and thereby permit an adversary to craft a file system that, when copied with scp(1) in a configuration that caused utimes(2) to fail (e.g. under a
SELinux policy or syscall sandbox), transferred different file names and contents to the actual file system layout. Exploitation of this is not likely as utimes(2) does not fail under normal circumstances. Successful exploitation is not silent - the output of scp(1) would show transfer errors followed by the actual file(s) that were received. Finally, filenames returned from the peer are (since openssh-8.0) matched against the user's requested destination, thereby disallowing a successful exploit from writing files outside the user's selected target glob (or directory, in the case of a recursive transfer). This ensures that this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol.
- Understand the differences between
- Review security advisories related to
scp: CVE-2019-6111 related to
scptool and protocol allowing to overwrite arbitrary files in the scp client target directory
pv </dev/zero | ssh REMOTE_SERVER 'cat >/dev/null'
scp -3-3 Copies between two remote hosts are transferred through the local host. Without this option the data is copied directly between the two remote hosts. Note that this option disables the progress meter.
- sftp, sftp configuration, Filezilla, Core FTP,
- OpenSSH (changelog),
openSSL, sshd logs,
Ssh -O stop