Re:File Transfer with SSH, Tee, and Base64
by nrclark on Thursday September 17, 2020 @12:09PM
(#24506389)
That sounds like it's an issue if one is copying from an untrusted server, for sure.
Maybe not an issue if you trust the machine you're copying to/from.
Re:File Transfer with SSH, Tee, and Base64
by Fnoord on Thursday September 17, 2020 @12:12PM
(#24506429)
> Maybe not an issue if you trust the machine you're copying to/from.
Maybe you shouldn't. After all, the remote machine doesn't have root on your machine. Even if you are root on the remote machine, how can you know the server isn't compromised? You can't.
The fact that a remote server gets to silently respond to the request "Hey, I'd like funny-cat-noises.mp3" by writing two files, funny-cat-noises.mp3 and also .security/overrides.conf ?
Maybe your understanding of the protocol was that you allow a remote server to write whatever files it wants to your disk. That seems like a pretty crazy thing to want, but OK.
Most people assume it does what it seems like it does. You name one or more files on one machine, and they're copied to the other machine. SFTP can deliver without nasty surprises, but SCP can't really do so, although the OpenSSH team have worked pretty hard to make the worst surprises less likely to bite you.