[Bug 2005] scp should not overwrite files (without confirmation)

[bugzilla-daemon at bugzilla.mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=2005

Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |WONTFIX

--- Comment #5 from Darren Tucker <dtucker at zip.com.au> 2012-05-16 13:55:48 EST ---
(In reply to comment #4)
> Ok I see,... some comments nevertheless:
> 
> 1) scp not only has the problem of not negotiating overwriting but also
> not supporting any extended attributes / ACLs.
> So I mean in principle, extensions to the "scp-protocol" would be
> necessary anyway.

no.  as explained, scp inextensible without causing interop problems.

> 2) Maybe I'm wrong with that, too, but on both side some process would
> have to write the file, right? And this process is ssh, right?

no, it's scp.  ssh is used only as an 8-bit clean transport.

> So at least it should be possible to specify on each side (in the
> config) a default whether to override per default or not, or not?

scp does not read any config files.

> I mean at least without any asking/negotiation or any notification (I
> guess it's not possible either to just give messages back to stdout)...
> 
> I would suggest then, that the default is _not_ to overwrite.

this would almost certainly break existing scripts expecting the
opposite behaviour.

> 3) How many scp implementations are out there, which are currently
> compatible with OpenSSH?
> Would it be feasible to sit together with them and standardise scp,
> e.g. as some RFC?

That's pretty much what happened with sftp, except that for all of the
reasons elaborated above it's not possible to interoperate with scp.

The final result was the 60-page "SSH File Transfer Protocol version
6": http://tools.ietf.org/id/draft-ietf-secsh-filexfer-13.txt.  We
stopped implementing at version 3
(http://openssh.com/txt/draft-ietf-secsh-filexfer-02.txt) when the
creeping featuritis kicked in.

It *would* be possible to implement what you're asking for in sftp,
either as a protocol extension (because the protocol is actually
extensible) or purely on the client side (albeit in a racy manner).

> 4) Is it possible for scp, to find out which scp server implementation
> it talks to?

no.  The scp command is sent blind.

> I guess it must be somehow possible, at least my nagios
> checks are able to get the implementation/version of remote SSHs.

That's is possible because SSH *is* designed to be extensible, and
there *is* a protocol negotiation.  Same is true of sftp.

> So why not determining this first and if OpenSSH was found adding some
> additional magic/syntax that makes this possible?

1) assuming the ssh server implementation is the same as the scp
implementation is likely to fail in some cases and 2) the scp command
never sees the ssh server details (it invokes ssh as a transport and is
not aware of the protocol details).

> For other clients/servers (2) should still be done, so that accidental
> overwriting when using mixed clients/servers could be prevented.

sorry, but no.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.