Subject: Do we have standards available for scp ??

From: Pankaj Bhagra <[email-masked]>
Date: Mon, 14 Jan 2002 20:13:36 -0800

Hi There,

Do we have any standards/draft/RFC for scp protocol. My initial search
over the web didn't returned any relevent information. 

My understanding of scp (very very limited) is that it is a wrapper
around ssh. Any pointers in these direction would definately help.

Brgds,
pankaj

---

From: David Terrell <[email-masked]>
Date: Tue, 15 Jan 2002 00:54:56 -0800

> around ssh. Any pointers in these direction would definately help.

scp is the bsd rcp protocol, exactly.  Only over ssh instead of rsh.

-- 
David Terrell             | "Anyone who says that is woefully
Prime Minister, Nebcorp   | underinformed.  IE, reads usenet."
[email-masked]              |  - Sean O'Connor
http://wwn.nebcorp.com/

---

From: Markus Friedl <[email-masked]>
Date: Tue, 15 Jan 2002 09:58:24 +0100

> over the web didn't returned any relevent information. 

no.
 
> around ssh. Any pointers in these direction would definately help.

it's just rcp over scp. there is not spec for rcp and i think
it's not worth specifying the rcp protocol because of limitations
discussed earlier on this list.

just use the rcp source...

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 15 Jan 2002 09:05:39 -0500

> just use the rcp source...

this is the wrong answer for the IETF.

someone has volunteered to do a scp/rcp Informational document but
they've been lame.  they should finish the draft.

					- Bill

---

From: Markus Friedl <[email-masked]>
Date: Tue, 15 Jan 2002 15:16:19 +0100

> this is the wrong answer for the IETF.

sure

> they've been lame.  they should finish the draft.

sure, but i don't think rcp can be fixed. it's been
deployed for years (decades?).

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 15 Jan 2002 09:42:04 -0500

> deployed for years (decades?).

it's still worthwhile to document existing practice.

					- Bill

---

From: Darren J Moffat <[email-masked]>
Date: Tue, 15 Jan 2002 07:54:36 -0800

> discussed earlier on this list.

I think the very reason that rcp has known limitations is a good idea to 
have it specified and marked is historical.  That way when the 
discussion comes up again there is a simple document to point to.

Having said that I don't think it is approriate work for this group to 
document rcp.

-- 
Darren J Moffat

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 15 Jan 2002 11:57:38 -0500

> scp is the bsd rcp protocol, exactly.  Only over ssh instead of rsh.

	IMHO, it would be strongly desirable to have a (possibly trivially 
short)
RFC describing SCP.  If RCP is already in an RFC, then it might cite
that RFC by reference and have a page or two about 'what is SCP' and
how it is implemented.  If RCP is not yet in an RFC, then the SCP RFC
might include that protocol definition.

	Either way, we ought not have SCP's definition only be folklore
on IETF mailing lists ("SCP is just BSD RCP over SSH instead of RSH"), 
IMHO.
I do really appreciate the email here today noting that fact; it is just
that this data needs to be archivally documented (whether or not on the
standards track as WG prefers).  RFCs are this community's archival 
document
series.

	Regrettably, I don't have time to do the SCP writeup myself just now.
Maybe someone else could volunteer to the SSH WG Chair ?

Ran
[email-masked]

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 15 Jan 2002 12:04:24 -0500

> deployed for years (decades?).

"Fixing RCP" isn't the issue here.  Documenting a widely deployed
protocol (e.g. SCP) is the important issue here -- even if that
means the "Security Considerations" section were to be lengthy
with the things that "need fixing" in SCP (if any).

Frankly, it would be also good to document RCP and to have a lengthy
description of why RCP is a bad idea operationally (e.g. list of
security risks with RCP) and even suggest using SCP instead (to
reduce security risks).  That's a bit outside this WG's charter
(potentially, subject to WG Chair decision), whereas documenting SCP
sufficiently to write an interoperable implementation from the RFC
would seem clearly within this WG's charter (also subject to WG Chair
decision).

IMHO,

Ran
[email-masked]

---

From: Markus Friedl <[email-masked]>
Date: Tue, 15 Jan 2002 18:21:22 +0100

On Tue, Jan 15, 2002 at 12:04:24PM -0500, RJ Atkinson wrote:
> reduce security risks).

But SCP == RCP (the protocols), so either _both_ are secure
or _none_.

> That's a bit outside this WG's charter

Well, documenting SCP means documenting RCP.

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 15 Jan 2002 12:27:00 -0500

Ran, 

There is no rcp RFC; rcp runs over rsh.  As I understand it, the rcp
client uses the rsh protocol to invoke rcp on the server, then the two
rcp's talk to each other over the rsh channel.

scp is just rcp over ssh -- scp uses ssh to invoke another scp on the
server, then the two scp's talk over the ssh channel using the exact
same protocol.

A historic or informational document on the existing practice of scp
is very much within scope for the working group; if this means that
the IETF community also gets an rcp document "for free", even better.

						- Bill

---

From: Daniel Prevett <[email-masked]>
Date: Tue, 15 Jan 2002 10:39:41 -0700 (MST)

I was under the impression that scp2 was a truncated sftp client, and that
scp1 was rcp over ssh.  I know that OpenSSH's implementation of scp can
use either an ssh1 or ssh2 connection, but that everyone else's
implementation of scp that uses ssh2 uses the sftp subsystem.  Could we
clarify which one we are talking about here?

Thanks,

-Daniel

---

From: Markus Friedl <[email-masked]>
Date: Tue, 15 Jan 2002 18:54:03 +0100

On Tue, Jan 15, 2002 at 10:39:41AM -0700, Daniel Prevett wrote:
> scp1 was rcp over ssh.

yes, now
	scp2 means the scp binary from SSH.com's 1.2.x software.
	scp1 means the scp binary from SSH.com's 2.x and 3.x software.

> I know that OpenSSH's implementation of scp can

it's what's called scp1 SSH.com's 1.2.x software.

scp1 speaks RCP.

---

From: Andrew Brown <[email-masked]>
Date: Tue, 15 Jan 2002 13:44:33 -0500

>But SCP == RCP (the protocols), so either _both_ are secure

well...yes and no.  they are almost the same, but there are also
places where they differ radically, depending on your point of view.
for example, in the source() routine of my netbsd-current rcp:

                if (pflag) {
                        /*
                         * Make it compatible with possible future
                         * versions expecting microseconds.
                         */
                        (void)snprintf(buf, sizeof(buf), "T%ld %ld %ld %ld\n",
                            (long)stb.st_mtimespec.tv_sec,
                            (long)stb.st_mtimespec.tv_nsec / 1000,
                            (long)stb.st_atimespec.tv_sec,
                            (long)stb.st_atimespec.tv_nsec / 1000);
                ...
                (void)snprintf(buf, sizeof(buf), "C%04o %lld %s\n",
                    stb.st_mode & RCPMODEMASK, (long long)stb.st_size, last);

whereas in the same routine in ssh-1.2.32 (as an example):

                if (pflag) {
                        /*
                         * Make it compatible with possible future
                         * versions expecting microseconds.
                         */
                        (void)snprintf(buf, sizeof(buf), "T%lu 0 %lu 0\n",
                                      (unsigned long)stb.st_mtime, 
                                      (unsigned long)stb.st_atime);
                ...
                (void)snprintf(buf, sizeof(buf), "C%04o %lu %s\n",
                              (unsigned int)(stb.st_mode & FILEMODEMASK), 
                              (unsigned long)stb.st_size, 
                              last);

the size of longs can differ between cpu architectures, and a long
long is not necessarily the same size as a long in all places either.
as protocols go, it works, but it appears to be looking for trouble.

>Well, documenting SCP means documenting RCP.

otoh, an existing document covering rcp would make the scp document a
lot easier.

-- 
|-----< "CODE WARRIOR" >-----|
[email-masked]             * "ah!  i see you have the internet
[email-masked] (Andrew Brown)                that goes *ping*!"
[email-masked]       * "information is power -- share the wealth."

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 15 Jan 2002 13:45:11 -0500

That this level of complexity exists in something this simple
really adds moment to the notion of documenting the existing
practice, IMHO.

---

From: Markus Friedl <[email-masked]>
Date: Tue, 15 Jan 2002 20:56:40 +0100

> for example, in the source() routine of my netbsd-current rcp:

well, that's not really a protocol issue.

> otoh, an existing document covering rcp would make the scp document a

sure.

I just wonder why nobody seems to care about core protocol issues,
but everybody cares about scp.

---

From: Andrew Brown <[email-masked]>
Date: Tue, 15 Jan 2002 15:04:18 -0500

>well, that's not really a protocol issue.

not an ssh protocol issue, certainly, but how scp or rcp talks to the
other end is.  using fsecure's scp to copy a five gigabyte file from
an x86 machine to an alpha won't work very well.  that's an *scp*
protocol failure, and that implies me that there ought to be some
simple guidelines.

>but everybody cares about scp.

because a lot of people like it?

---

From: Thor Simon <[email-masked]>
Date: Tue, 15 Jan 2002 17:03:46 -0500

> protocol failure, and that implies me that there ought to be some

Really, the only thing wrong with F-secure's scp is that it's *REALLY OLD*.
It is missing bugfixes that went into BSD's rcp about a decade ago.  Indeed,
'rcp' of the 4.2BSD era will not work correctly between an x86 and an Alpha.

I have an Informational RFC on 'rcp' pretty much ready (FWIW, I document the
modern version of the protocol, not the ancient version F-Secure used for
their scp; generally, these interoperate, except in conditions like the one
Andrew describes above) but there was highly negative raction last time I
mentioned that on this list so I decided not to spend more time on it.  Did
I misapprehend the general feeling about this subject?

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 15 Jan 2002 17:05:28 -0500

> I misapprehend the general feeling about this subject?

There certainly seems to be interest.

						- BIll

---

From: Markus Friedl <[email-masked]>
Date: Thu, 17 Jan 2002 22:59:37 +0100

> other end is.  using fsecure's scp to copy a five gigabyte file from

btw, 1.2.32 is not from f-secure

---

From: Andrew Brown <[email-masked]>
Date: Thu, 17 Jan 2002 17:11:14 -0500

>btw, 1.2.32 is not from f-secure 

that's quite true.  i keep confusing ssh.com and fsecure for some
reason.  i don't know why.  but...my point still stands.  :)