Bug 766 - minor optimization: check local path and file names before password prompt
Summary: minor optimization: check local path and file names before password prompt
Status: REOPENED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: scp (show other bugs)
Version: -current
Hardware: All All
: P5 enhancement
Assignee: OpenSSH Bugzilla mailing list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2003-12-01 09:10 AEDT by Mark Stosberg
Modified: 2005-04-21 19:18 AEST (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Stosberg 2003-12-01 09:10:47 AEDT
Here's a suggestion for a minor enhancement to scp. Currently  scp asks you for
the remote password even when it's going to ultimately fail because a local path
name is broken.

I would consider it an enhancement if the local path and file names were checked
first, and a failure message emitted without ever prompting for the remote
password in this case. 

Here's a screenshot of what happened recently:

####
    mark@nollie$ scp asana:file.txt t/
    mark@asana's password:
    t/: No such file or directory
############
Comment 1 Jim Knoble 2003-12-01 10:05:58 AEDT
Bad idea; information leakage.  This would allow anyone, with or without a valid
account on the target machine, to check for the existence of a file or
directory.  Yucky.
Comment 2 Mark Stosberg 2003-12-01 10:33:12 AEDT
I don't understand how this is information leakage. For local files, I
can already check if a file exists or not, as well as I can if Irun 'scp' to do
it.

For uses where scp requires a password, that will of course need to be
given before any files are checked as another user, so no information
should be leaked there, either.

In any case, it's minor optimization. I thought I'd suggest it.
 
I use ssh and scp and everyday and find them extremely useful.

Thanks for your work on the project!

  Mark
Comment 3 Ben Lindstrom 2003-12-01 10:41:01 AEDT
If you have a patch to change this behavior then we will consider it.  At this 
point I don't think it is high on any of our todo lists.  

I believe people have looked at this before and the amount of code that would 
be touched was greater than most were comfortable with doing.

- Ben
Comment 4 Mark Stosberg 2003-12-01 10:55:07 AEDT
I understand. I won't be offended if you send it to the bit bucket, then. :) I
can imagine there are more pressing issues to deal with. 

Thanks for the response.

  Mark
Comment 5 Damien Miller 2005-04-21 18:09:06 AEST
No, we can't do this because scp isn't actually started until *after* the user
is logged in. Therefore it has no opportunity to check.
Comment 6 Damien Miller 2005-04-21 19:18:25 AEST
dtucker@ points out the error of my ways: you can do this for the remote ->
local case.