Ubuntu
scponly package

scponly-4.6* doesn't support new -l/-f option of sftp-server

Bug #196365 reported by tsekine
6
Affects Status Importance Assigned to Milestone
scponly (Ubuntu)
Invalid
Undecided
Unassigned

Bug Description

Binary package hint: scponly

1) Ubuntu release

DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=7.10
DISTRIB_CODENAME=gutsy
DISTRIB_DESCRIPTION="Ubuntu 7.10"

2/3) package name/version
scponly-4.6-1.1

4/5) What I expected expected / What happened

openssh-server-4.6p1-5ubuntu0.1 supports -l and -f option of sftp-server.
But scponly doesn't allow any argument for sftp-server.
Then, scponly blocks sftp-server program execution if sshd_config is
set up to use -l or -f option.

Revision history for this message
tsekine (tsekine-google) wrote :
Revision history for this message
Yann (lostec) wrote :

Confirmed on released Hardy up to date 23 JUIL 08
If you enable debug log in scponly (see scponly wiki), you'll see the sftp-server command is refused because of sftp logging arguments.

This is a problem because SFTP servers are often chrooted to home dirs in production environments and logging users is sometime mandatory (corporate security rules, legal aspects for some services/countries). For a LTS version targeting corporate market this is a big issue that should be solved applying given patch or updating to scponly 4.8 (compiled with appropriate option to enable sftp logging).

Regards

Changed in scponly:
status: New → Confirmed
Revision history for this message
tsekine (tsekine-google) wrote :

FYI, as Yann mentioned, upstream version of scponly(scponly 4.8) already has supported sftp logging. My patch is only for people who really want not to upgrade scponly.

Revision history for this message
Phillip Susi (psusi) wrote :

This package has been removed from Ubuntu. Closing all related bugs.

Changed in scponly (Ubuntu):
status: Confirmed → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.