|
 |
9070b3 |
diff -up openssh-8.7p1/pathnames.h.kill-scp openssh-8.7p1/pathnames.h
|
|
|
9070b3 |
--- openssh-8.7p1/pathnames.h.kill-scp 2021-09-16 11:37:57.240171687 +0200
|
|
|
9070b3 |
+++ openssh-8.7p1/pathnames.h 2021-09-16 11:42:29.183427917 +0200
|
|
|
9070b3 |
@@ -42,6 +42,7 @@
|
|
|
9070b3 |
#define _PATH_HOST_XMSS_KEY_FILE SSHDIR "/ssh_host_xmss_key"
|
|
|
9070b3 |
#define _PATH_HOST_RSA_KEY_FILE SSHDIR "/ssh_host_rsa_key"
|
|
|
9070b3 |
#define _PATH_DH_MODULI SSHDIR "/moduli"
|
|
|
9070b3 |
+#define _PATH_SCP_KILL_SWITCH SSHDIR "/disable_scp"
|
|
|
9070b3 |
|
|
|
9070b3 |
#ifndef _PATH_SSH_PROGRAM
|
|
|
9070b3 |
#define _PATH_SSH_PROGRAM "/usr/bin/ssh"
|
|
|
9070b3 |
diff -up openssh-8.7p1/scp.1.kill-scp openssh-8.7p1/scp.1
|
|
|
9070b3 |
--- openssh-8.7p1/scp.1.kill-scp 2021-09-16 12:09:02.646714578 +0200
|
|
|
9070b3 |
+++ openssh-8.7p1/scp.1 2021-09-16 12:26:49.978628226 +0200
|
|
|
9070b3 |
@@ -278,6 +278,13 @@ to print debugging messages about their
|
|
|
9070b3 |
This is helpful in
|
|
|
9070b3 |
debugging connection, authentication, and configuration problems.
|
|
|
9070b3 |
.El
|
|
|
9070b3 |
+.Pp
|
|
|
9070b3 |
+Usage of SCP protocol can be blocked by creating a world-readable
|
|
|
9070b3 |
+.Ar /etc/ssh/disable_scp
|
|
|
9070b3 |
+file. If this file exists, when SCP protocol is in use (either remotely or
|
|
|
9070b3 |
+via the
|
|
|
9070b3 |
+.Fl O
|
|
|
9070b3 |
+option), the program will exit.
|
|
|
9070b3 |
.Sh EXIT STATUS
|
|
|
9070b3 |
.Ex -std scp
|
|
|
9070b3 |
.Sh SEE ALSO
|
|
|
9070b3 |
diff -up openssh-8.7p1/scp.c.kill-scp openssh-8.7p1/scp.c
|
|
|
9070b3 |
--- openssh-8.7p1/scp.c.kill-scp 2021-09-16 11:42:56.013650519 +0200
|
|
|
9070b3 |
+++ openssh-8.7p1/scp.c 2021-09-16 11:53:03.249713836 +0200
|
|
|
9070b3 |
@@ -596,6 +596,14 @@ main(int argc, char **argv)
|
|
|
9070b3 |
if (iamremote)
|
|
|
9070b3 |
mode = MODE_SCP;
|
|
|
9070b3 |
|
|
|
9070b3 |
+ if (mode == MODE_SCP) {
|
|
|
9070b3 |
+ FILE *f = fopen(_PATH_SCP_KILL_SWITCH, "r");
|
|
|
9070b3 |
+ if (f != NULL) {
|
|
|
9070b3 |
+ fclose(f);
|
|
|
9070b3 |
+ fatal("SCP protocol is forbidden via %s", _PATH_SCP_KILL_SWITCH);
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+
|
|
|
9070b3 |
if ((pwd = getpwuid(userid = getuid())) == NULL)
|
|
|
9070b3 |
fatal("unknown user %u", (u_int) userid);
|
|
|
9070b3 |
|