3

The tool WinSCP is able to perform a sudo on the remote machine to perform the scp as the sudo user. That leads me to think that this must be possible with the command-line version of scp as well.

Under the wraps, how is WinSCP executing this?

I do not want to work through a solution with a user staging directory. Files might be so big that I am required to post directly using the sudo user. As a result the file copied over, but to my local dir, not the sudo dir.

One solution might be by manually piping over ssh:

tar zcvf -  MyBackups | ssh user@server "cat > /path/to/backup/foo.tgz"

Which I guess could customize to do the sudo as follows:

cat local.txt | ssh user@server "sudo -u sudouser cat > ~/remote_file"

Only problem is that by doing it this way, I have a lot of burden to solve that has been implemented using base scp already. For this and other reasons, I do not want to use this solution either.

Howe can I let scp handle a direct copy to remote using a sudo to change the user so I gain access to it's privileges.

Community
  • 1
YoYo
  • 189

2 Answers2

1

Scp works by making an ssh connection to the remote server, then using that connection to execute another scp command on the remote system. The local scp instance and and the remote instance communicate through the ssh link to send or receive files.

OpenSSH scp in particular constructs an scp command string to be run on the remote system. Then it launches ssh to run that command. The eventual ssh command invoked is the equivalent of this:

/path/to/ssh [ssh options...] "scp [scp options...]"
  • /path/to/ssh is normally a built-in path to the ssh program.
  • [ssh options...] is one or more options to the ssh program.
  • "scp [scp options...]" is a single argument containing the scp command and its arguments to run on the remote system.

OpenSSH scp doesn't provide much in the way of options to alter the form of the remote scp command. There's no way to have it invoke something other than "scp", or to insert something like "sudo" in front of the "scp" part.

As you've noticed, scp does have an option to invoke some other program rather than ssh. Someone who knew how could write an ssh wrapper program and have scp invoke the wrapper instead of invoking ssh directly. The wrapper would have to examine its command-line arguments to find the one containing the scp command, alter the command as desired, and then invoke ssh with the altered command-line arguments.

Kenster
  • 8,620
0

How SCP works

The internal workings of scp depends on two undocumented forms of scp, which is scp -f and scp -t. They are basically remote servers listening to stdin and generating data over stdout. Those processes use a protocol similar to what sftp would do. More information can be found at an Oracle Blog.

When scp starts, it will first start a ssh session to start scp -t or scp -f. Your local scp process will then communicate with the remote scp process through stdout and stdin piped to ssh (fully encrypted) and will serve as stdin/stdout for your remote scp session.

How to Customize

The scp command provides an option -s that allows you to customize the program used to setup the remote scp session. It is expected to handle all the options typical for ssh. To help debug how that might look like, we setup a dummy program that just dumps the parameters:

/tmp/scp-dump.sh:

echo $0 $*

We will execute it as follows:

scp -S /tmp/scp-dump.sh /tmp/dump.txt me@server.com:/tmp

And appropriately we get the following output:

/home/me/dump.sh \
    -x -oForwardAgent=no \
    -oPermitLocalCommand=no \
    -oClearAllForwardings=yes \
    -l me -- server.com scp -t /tmp

Line-breaks with backslash were added for readability.

That allows us an opportunity to modify the parameters and commands before we send it to the ssh command.

Setting up sudo

now we can write a program to modify the parameters as needed, start ssh, and use a modified form to start scp -t. We will basically capture the parameters, trap those we want to use internally only add additional ones, and make changes.

/tmp/scp-sudo.sh:

add_ssh_option() {
  local option
  if [ $# = 2 ]; then
    option="$1 \"$2\""
  else
    option="$1"
  fi
  if [ -z "${ssh_options}" ]; then
    ssh_options=${option}
  else
    ssh_options="${ssh_options} ${option}"
  fi
}

parse_options() {
  ssh_options=
  local option
  while [ $# > 0 ] ; do
    case $1 in
      -oSudoUser=* )
        SSH_SUDO_USER=${option##=}
        shift
        ;;
      -l ) ssh_user=$2 ; shift 2 ;;
      -i ) add_ssh_option "$1" "$2" ; shift 2 ;;
      -- ) shift ; break ;;
      - ) add_ssh_option "${1}" ; shift ;;
      *  ) break ;;
    esac
  done
  ssh_host=$1
  shift
  ssh_command="$*"
}


parse_options "$@"


To avoid intererence with Standard-In, we change this to


Strict:


add_ssh_option "-oStrictHostKeyChecking=yes"


if [ -z "${SSH_SUDO_USER}" ]; then


As before without sudo


cat | ssh $ssh_options -l $ssh_user $ssh_host $ssh_command
  exit $?
else


Send standard-in to the customized "scp -t" sink.


cat | ssh $ssh_options -l $ssh_user $ssh_host sudo -i -u ${SSH_SUDO_USER} $ssh_command
  exit $?
fi

Now we can use the modified scp form:

scp -oSudoUser=other \
    -i /tmp/me-id_rsa \
    /tmp/scp-sudo.sh \
    /tmp/dump.txt \
    me@server.com:/tmp

This works fine for sending a file to remote. However when I retreive a remote file, it somehow hangs. When I break the session (control-c), I do see that the transfer was succesful, but I have somehow an extra file named "0". Wonder if anyone can help me with that?

Better Option: sftp

However sftp is much better.

  1. it has the -S option - allowing to set the entire ssh command line. I had trouble figuring it out and making it to work. I suspect that I do not understand how to correctly bind stdin/stdout from within a shell-ssh wrapper.
  2. it has a -s (lowercase) option - allowing to set just the sub-command responsible for setting up the remote server only. I found this easier to make it work.
  3. You can set the remote path, remote file permissions, do both put/get, etc as per the man pages for sftp.

In this case we just simply

sftp -s "sudo -u sudo-user -- /usr/libexec/openssh/sftp-server" me@server.com

That gave me the happy "sftp>" prompt

Note that the subprogram is sometimes located in different paths, example /usr/libexec/openssh/sftp-server. I would suggest parsing from the "Subsystem sftp" string from within the /etc/ssh/sshd_conf file?

Community
  • 1
YoYo
  • 189