[scponly] problem with CISCO devices ?

[Kaleb Pederson]

On Tue, Aug 9, 2011 at 7:25 AM, Armin Wies <armin.wies at mscsoftware.com> wrote:
...
>> I have noticed that the scp-command looks a bit different [copying from switch…]
>>
>> Aug  1 13:57:51 MYSERVER scponly[26454]: running: /usr/bin/scp -v -t
>> /home/bu/in/fromswitch (username: bu(6666), IP/port: 172.17.X.Y 32161
>> 22)

That command should be perfectly valid.  The '-v' option is for
verbose mode and is passed to the server side when any time an OpenSSH
scp client is put in verbose mode.

>
> I guess here is the problem.... :
> /usr/bin/scp -v -t /home/bu/in/fromswitch
>
> doesn't seem to be valid, as IMHO scp sees /home/bu/in/fromswitch as
> the source and the destination is missing.

The source comes over the wire. In this case, /home/bu/in/fromswitch
is expected to be a file or directory depending on how scp was
invoked.

> I actually see this with an strace:

Thanks for doing your homework :).

> DEBUG1.29480:stat("/home/bu/in/fromswitch", 0x7fff885412a0) = -1
> ENOENT (No such file or directory)

This is likely the problem.  It's not finding the file/directory for
some reason. You should be able to figure out where things break down
by doing something pretty basic, like the following:

ssh you at yoursystem "ls -l /"
ssh you at yoursystem "ls -l /home"
ssh you at yoursystem "ls -l /home/bu"
ssh you at yoursystem "ls -l /home/bu/in"
ssh you at yoursystem "ls -l /home/bu/in/fromswitch"

Or:

$ sftp you at yoursystem
sftp> ls -l /
sftp> ls -l /home
... and so on

If you have enabled a chrooted binary, then keep in mind that the
paths being sent shouldn't include the path to the chroot.

> Do you need further debugging output ?

Try the above and if let us know if you still have problems.

--
Kaleb Pederson
Blog - http://kalebpederson.com
Twitter - http://twitter.com/kalebpederson