mainSavannah Administration - Support: sr #110690, can't upload

 
 

sr #110690: can't upload

Submitter:  Ben Asselstine <benasselstine>
Submitted:  Sat 06 Aug 2022 12:18:08 PM UTC
   
 
Category:  Download area - developer access Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  rwp
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 18 Aug 2022 10:23:42 PM UTC, comment #4: 

Done.  Updated.  Please try it again now.

The root cause of this problem is almost certainly that recently you have upgraded your system to OpenSSH 9.0 and the upstream OpenSSH at 9.0 has switched the internal protocol of scp from the legacy (and problematic) scp/rcp protocol to using sftp internally instead.  This is actually a very good upgrade and I welcome it but the result was that it switched the protocol to one that has been blocked due to a security concern.

https://www.openssh.com/txt/release-9.0

Just for completeness I will say that OpenSSH provides the scp -O option to use the previous now obsolete scp protocol.  That would have forced use of the old scp protocol and worked.  But it is not needed because I reviewed the issue with sftp and believe it is not a problem for Savannah due to the special nature of Savannah only hosting Free Software and nothing more.

In 2016 Sylvain Beucler reported a security issue with use of the sftp protocol such that members may access as themselves the raw file system.  On other systems that would be a problem of information leakage.  But on Savannah all of the files are accessible from the public side of things already.  There isn't anything visible from this information leakage hack that isn't already visible by other means.  Therefore I have enabled the sftp protocol again regardless of the possible leakage to members.

I have updated the documentation for the scp and rsync commands.

https://savannah.nongnu.org/maintenance/DownloadArea/

In particular your original scp command should work okay now.  And also when using rsync do not use the -a option, for other reasons unrelated to this report that attempts a chown operation which is blocked and results in a hang and failure.  Using -t is sufficient.

Due to the change in security policy I will raise this for further discussion with the other admin team members.  If no one sees a problem with this line of reasoning then everything will stay this way for the future.  If concerns are raised however then we will need to update the policy to react to it.

Bob Proulx <rwp>
Site Administrator
Wed 17 Aug 2022 08:52:10 PM UTC, comment #3: 

Sorry I was recently consumed working on
https://savannah.nongnu.org/support/?110692#comment4
which is now resolved. I don't yet have an update on the upload problem but it is now next in the my queue.

Bob Proulx <rwp>
Site Administrator
Fri 12 Aug 2022 11:34:17 AM UTC, comment #2: 

I tried what you suggested and also tried this after reading the page at: https://savannah.gnu.org/maintenance/SavannahServices/

$ rsync -avvhP gmoria-5.7.3.tar.gz benasselstine@download.savannah.gnu.org:/srv/download/gmoria/gmoria-5.7.3.tar.gz
opening connection using: ssh -l benasselstine download.savannah.gnu.org rsync --server -vvlogDtpre.iLsfxCIvu --partial . /srv/download/gmoria/gmoria-5.7.3.tar.gz  (10 args)
sending incremental file list
[hangs]

what do you think?

Anonymous
Fri 12 Aug 2022 01:52:54 AM UTC, comment #1: 

I recall that scp was disabled due to a security vulnerability.  Please use rsync instead.  Try this.

rsync -av gmoria-5.7.3.tar.gz benasselstine@dl.sv.nongnu.org:/releases/gmoria/

Bob Proulx <rwp>
Site Administrator
Sat 06 Aug 2022 12:18:08 PM UTC, original submission:  

I try to scp a new version like so:
scp  gmoria-5.7.3.tar.gz benasselstine@dl.sv.nongnu.org:/releases/gmoria/

and it just says connection closed.

I know my ssh keys work because I can git push and so on.

Adding -vv to the scp doesn't yield anything interesting.

Do you have any helpful hints for me?

Ben Asselstine <benasselstine>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by benasselstine (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-08-18 rwp StatusNone Done
        Assigned toNone rwp
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-bb6a.
    Corresponding source code