openssh bugs - Dec 2003 - [Bug 766] minor optimization: check local path and file names before password prompt

http://bugzilla.mindrot.org/show_bug.cgi?id=766

           Summary: minor optimization: check local path and file names
                    before password prompt
           Product: Portable OpenSSH
           Version: 3.6.1p2
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: enhancement
          Priority: P2
         Component: scp
        AssignedTo: openssh-bugs at mindrot.org
        ReportedBy: mark at summersault.com


Here's a suggestion for a minor enhancement to scp. Currently  scp asks you
for
the remote password even when it's going to ultimately fail because a local
path
name is broken.

I would consider it an enhancement if the local path and file names were checked
first, and a failure message emitted without ever prompting for the remote
password in this case. 

Here's a screenshot of what happened recently:

####
    mark at nollie$ scp asana:file.txt t/
    mark at asana's password:
    t/: No such file or directory
############



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=766





------- Additional Comments From jmknoble at pobox.com  2003-12-01 10:05 -------
Bad idea; information leakage.  This would allow anyone, with or without a valid
account on the target machine, to check for the existence of a file or
directory.  Yucky.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=766





------- Additional Comments From mark at summersault.com  2003-12-01 10:33
-------
I don't understand how this is information leakage. For local files, I
can already check if a file exists or not, as well as I can if Irun
'scp' to do
it.

For uses where scp requires a password, that will of course need to be
given before any files are checked as another user, so no information
should be leaked there, either.

In any case, it's minor optimization. I thought I'd suggest it.
 
I use ssh and scp and everyday and find them extremely useful.

Thanks for your work on the project!

  Mark



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=766

mouring at eviladmin.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P2                          |P5
            Version|3.6.1p2                     |-current



------- Additional Comments From mouring at eviladmin.org  2003-12-01 10:41
-------
If you have a patch to change this behavior then we will consider it.  At this 
point I don't think it is high on any of our todo lists.  

I believe people have looked at this before and the amount of code that would 
be touched was greater than most were comfortable with doing.

- Ben



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=766





------- Additional Comments From mark at summersault.com  2003-12-01 10:55
-------
I understand. I won't be offended if you send it to the bit bucket, then. :)
I
can imagine there are more pressing issues to deal with. 

Thanks for the response.

  Mark



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.