22

An SCP I've been using for a long time to upload files has suddenly stopped working. I ran the script 12 hours ago and it worked just fine, but has suddenly stopped.

The command in question was uploading the current directory to a remote folder:

#!/bin/bash
cd "$(dirname "$0")"

scp -r . <remote_server>:<remote_folder>

The error message is:

scp: error: unexpected filename: .

I'm on a Mac running Mojave 10.14.2.

UPDATE: I have solved the specific problem by rewriting the command to this, but I'd still be interested to know what broke:

scp -r $(pwd) <remote_server>:<remote_folder>
Improve this question
2
  • I tried on Mojave 10.14.3 and it works. Is the directory empty? – Matteo Feb 8 '19 at 11:27
  • Please post your answer separately so you get credit for it and other people will find it. I missed seeing it and is why I posted a near duplicate. – AndrewD Aug 22 '19 at 23:32
22

The culprit is CVE-2018-20685, whose description is:

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

This is part of a larger set of SCP vulnerabilities. Quoting from there:

Overview

SCP clients from multiple vendors are susceptible to a malicious scp server performing unauthorized changes to target directory and/or client output manipulation.

Description

Many scp clients fail to verify if the objects returned by the scp server match those it asked for. This issue dates back to 1983 and rcp, on which scp is based. A separate flaw in the client allows the target directory attributes to be changed arbitrarily. Finally, two vulnerabilities in clients may allow server to spoof the client output.

The commit that patched this vulnerability in OpenBSD was made on Nov. 16, 2018

Improve this answer
7
  • 2
    Thanks for the explanation. So my SCP somehow got updated over night to include this patch is why it stopped working? – Eliezer Steinbock Feb 8 '19 at 14:31
  • 4
    Making the scp tool unable to process the standard directory entry "." is an AWFUL solution to this! There must be 10's of other ways they could have solved this (perhaps by verifying that the returned objects ARE what was asked for?)... This is "security by the least effort expended", which is next in line after "security by not publishing the hostname"... – Haqa Feb 12 '19 at 11:54
  • 1
    Great answer, now I know why my scp scripts on Ubuntu no longer work. But what is the solution? I cannot use * instead of . because the folder contains thousands of files. Is there a new switch to turn off this behaviour? – Stéphane Feb 12 '19 at 20:35
  • 2
    @Stéphane use $(pwd) instead of . – BlackBear Feb 13 '19 at 7:35
  • 3
    @BlackBear It's not the same. . allow to copy all files (including those starting with a dot) without copying directory itself. scp -r $(pwd) <host>:<dest. dir> and scp -r . <host>:<dest. dir> ARE different. In first case you've got <dest. dir>/<current dir name>/<files list> when you've got <dest. dir>/<files list> with second case. – Bil Mar 5 '19 at 8:51
10

The other answer from @BlackBear explains why this no longer works.

But if like me you ended up on this question also looking for a solution, it seems the right way to do it is with rsync instead of scp. For example, one of my old scp commands would have looked like this:

# this no longer works due to the "."
scp -BCr output/html/. www:/var/www/site/html/

Now instead I use this:

rsync --recursive --times --compress --delete --progress output/html/ www:/var/www/site/html/

If you prefer the shorter flags, it would look like this:

rsync -rtz --del --progress output/html/ www:/var/www/site/html/

The trailing / on the source is important. It tells rsync you want the content of that directory without the directory name.

Also consider --dry-run and man rsync before messing things up.

Improve this answer
4
  • This solution doesn't work for Windows. On Windows only the scp command exists but the rsync doesn't. – Spenhouet May 20 '19 at 19:49
  • @besnep If you don't have it, you'll have to install it: google.com/search?q=rsync+for+windows – Stéphane May 21 '19 at 23:45
  • The question had already been edited to provide a solution (one without rsync). In summary, replace the . with $(pwd) – Jan D Nov 10 '19 at 13:42
  • 2
    @JanD Using $(pwd) doesn't work when you're trying to upload directories that are not the current working directory, which is why I provided the answer I did. Take a look at the very first example in my answer, this is taken verbatim from a script which used the "." notation that scp no longer supports. – Stéphane Nov 11 '19 at 1:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.