#Openssh version Patch#

We are aware of several differences in the behaviors of the SCP and SFTP protocols. Differences between SCP and SFTP protocols

A major release is the proper time to introduce changes of this nature, because those who migrate to the new major versions are more likely to expect possible incompatibilities. Though upstream has delayed switching to the SFTP protocol by default, we decided to switch completely in RHEL 9. Since then, it has been updated with several compatibility tweaks to better match the SCP behavior and to correctly handle what corner cases have been discovered so far.

#Openssh version Patch#

In 2021, Jelen’s patch was accepted upstream with minor tweaks. The initial patch implementing the switch was written by Jakub Jelen, the Red Hatter who maintained the OpenSSH package for several years and who knows the toolkit’s internals very well. At the same time, we have SFTP, a well-defined protocol that covers most of SCP’s use cases, so it makes sense to switch to the better protocol. New issues are being reported frequently ( CVE-2020-15778 is the most recent as of this writing, but we can’t be sure it will be the last) and it is rather difficult to fix them all properly because the protocol is inherently trustworthy of authenticated sessions.įor this reason, some RHEL customers wish to completely disable the SCP protocol in their systems. We’re making this change because the SCP protocol is decades old, and carries multiple security risks and issues that have no straightforward solutions. If the file /etc/ssh/disable_scp exists, any attempt to use the SCP protocol will fail. Usage of the SCP protocol can be completely disabled on the system. Usage of the SCP protocol can be restored using the newly added -O option. The scp command line tool uses the SFTP protocol for file transfers by default. These are the changes that we have implemented:

One of the most important security changes for OpenSSH in Red Hat Enterprise Linux (RHEL) 9 is the deprecation of the SCP protocol.