Feature request - From SCP Publisher towards SFTP Publisher

[talcher]

Hello the EJBCA team,

I can implement the SCP Publisher (ejbca-ce-r8.3.2) without any trouble.
However, if I implement SFTP on the server side, the client encounters an error:

ERROR [org.ejbca.scp.publisher.ScpPublisher] (default task-6) SCP error: his service allows sftp connections only
: java.io.IOException: SCP error: his service allows sftp connections only.

My suggestion is: would it be possible to change this feature not to use scp anymore, but to rely on sftp instead? Or, at least, to rely on sftp by default, with the possibility given to the user to opt out and choose scp if they wish, for backwards-compatible reasons.

The pros are:

• sftp is more secure than scp
• sftp can properly implement chroot features
• the use of scp has been discouraged by the OpenSSH team for more than five years now.

Let me know your mind about that idea!

Best regards,

talcher

(Edit: added the client-side error when the server implements SFTP)

[mike-agrenius-kushner]

Hi,

We have some refurbishment of the SCP Publisher (hopefully) planned for early next year – switching to sftp is high on the priority list there.

Cheers,
Mike

[talcher]

Thanks for your reply.
Take heart in the refurbishment!

talcher