openssh unix dev - Dec 2023 - Non-shell accounts and scp/sftp

On Mon, 11 Dec 2023, Philip Prindeville wrote:
> 
> 
> > On Dec 10, 2023, at 10:41?PM, Damien Miller <djm at mindrot.org>
wrote:
> > 
> > On Fri, 8 Dec 2023, Darren Tucker wrote:
> > 
> >> On Fri, 8 Dec 2023 at 07:39, Philip Prindeville
> >> <philipp_subx at redfish-solutions.com> wrote:
> >> [...]
> >>> Problem is that if their default shell isn't sh, ash,
dash, bash, zsh, etc. then things break.
> >>> Is there a workaround to allow scp/sftp to continue to work
even for non-shell accounts?
> >> 
> >> sftp should work regardless of the user's shell since it is
invoked as
> >> a ssh subsystem which is independent of the shell channel.
> > 
> > I'm pretty sure sshd executes subsystems using the user's
configured
> > shell.
> > 
> > You should be able to use "Subsystem sftp internal-sftp" to
skip the
> > shell though.
> > 
> > -d
> 
> 
> I configured the server for "Subsystem sftp sftp-internal" but
still not working:
> 
> 
> pprindeville at ubuntu-ng:~/work/tnsr-pkgs$ scp -s -vvvv Makefile
pprindeville2 at 172.21.12.17:/tmp/
yeah, because you're 1) using scp and not sftp and 2) using an old (OpenSSH
<9.0) version of scp that doesn't use the SFTP protocol under the hood. 
protocol. That changed in OpenSSH 9.0.
> OpenSSH_8.9p1 Ubuntu-3ubuntu0.4, OpenSSL 3.0.2 15 Mar 2022

On 12/12/2023 02:07, Damien Miller wrote:
> yeah, because you're 1) using scp and not sftp and 2) using an old
(OpenSSH
> <9.0) version of scp that doesn't use the SFTP protocol under the
hood.
> protocol. That changed in OpenSSH 9.0.
However, the client log did say:

debug1: Sending subsystem: sftp
debug2: channel 0: request subsystem confirm 1

Seeing a log from the server side could be illuminating: e.g. 
/usr/sbin/sshd -d -p 99 (and then sftp to port 99)