Re: [Gnu-arch-users] Re: WebDAV

[Robin Green]

On Fri, Apr 09, 2004 at 11:56:30AM -0400, Aaron Bentley wrote:
> Yet another instance where security is not simple.  I think "sftp" is a 
> misleading name, since ftp doesn't permit remote command execution.

On the contrary. Some ftp servers were implemented by calling the local
"ls" on the system, which led to exploits.

By contrast, sftp does not permit remote command execution. You can either
give someone a shell account, which implies sftp access - or, without any
third-party tools, you can put their public key in a special sftp user's
authorized_keys file and flag it so that it can _only_ be used to do sftp.
This is not well-known because it's tucked away in the openssh documentation.
 
> Absent a secure shell, sftp is less secure in some ways.

Huh?
-- 
Robin

pgptqq9xFRrE6.pgp
Description: PGP signature