The fact scp "worked" illustrates that such "How to secure your server" guides are... at best... poorly thought out. If "remote file access" is not in fact a "necessary service" then you can't very well allow scp to work, and thus you can't allow basic ssh service.

Actually a more sane setup, which I've used, is only SFTP is enabled, no shells. You can fetch files, you can send files, but you can't... for example... run a race exploitation shell script to seize root permissions.

This also has the advantage that if we can only send and receive files, the "server" we're connecting to needn't really exist, like an HTTP virtual host it's just a bunch of "files" and could actually be backed by a database with some blob tables.

There's a lot of scp usage in a typical corporate environment that should actually be files living in a shared filestore anyway, I've seen way too many files which ought to actually be:

* A wiki entry

* Checked into a git repository

* Shared in some cloud service e.g. OneCloud

... but instead they live on Steve's F:\Documents and if Steve is off sick well, here's the copy I made last week, I hope it isn't missing any important updates and somebody make sure Steve gets this when we change it...

The file living in /usr/project/ on testserver03 instead of F:\Documents on Steve's laptop is not a real improvement.

You're actually making the opposite argument that you think you're making: if the scp command stops working, from a "corporate" perspective, from all intents and purposes, it means that "our server no longer works with scp due to an update". Regardless of implementation details, the opposite will then happen: whoever is in charge will request for "SCP to be fixed", which will actually mean turning on SFTP support.

Removing options from "corporate" users usually results in saner choices being made, because you stop being able to bikeshed the implementation details. People have a server and they need a way to transfer files. If you have two protocols that can be used, arbitrary decisions will be made. If the readily available tools all break, there is no more decision to be made – whatever needs to be enabled will be enabled.

if regular ssh is available, nothing stops people from building pipes with tar on both ends. This will be integrated into additional tools (future "show HN - scp replacement written in $FANCY_LANGUAGE that works even when sftp is disabled") and will be the "new way" of doing things because it won't require any configuration change on the server.

Never underestimate the inertia of server configurations.

> (future "show HN - scp replacement written in $FANCY_LANGUAGE that works even when sftp is disabled")

Too late:

https://en.wikipedia.org/wiki/Files_transferred_over_shell_p...

In KDE this is implemented as a standard protocol handler ("ioslave") and you can access it from most KDE apps using URLs like "fish://user@server/":

https://docs.kde.org/trunk5/en/kio-extras/kioslave5/fish/ind...

The snag in tbis plan is that wildcard copies dont work in the new scp tool. Serious usability downgrade to the new system. :(