Can the server admin see what I copy via SCP

scpssh

Say I am connecting to a server via SCP and copying some files from the remote server to my home computer. Can the server admins tell that I have copied something, see what was copied, or know who copied it?

Best Answer

A ServerFault question is almost identical to this. Hopefully you checked before posting your question, but yours is a little different so I will answer here.

The short answer is that if ANYONE has access and permissions to an endpoint (the system you are scping from or scping to), they can see what happens. If they do not have access to either endpoint, they likely won't have access to or be able to decipher what you're doing (apart from potentially knowing the application by protocol numbers).

The answer is ultimately very dependent on your infrastructure. Most likely though, as long as there isn't intense monitoring and SCP isn't considered at threat in the company (which will throw up red flags), your traffic will go by unnoticed. This is especially true for smaller companies.

As @SimonRichter mentioned: if someone can execute a command on your system (ie. admin or others), they can check your process list and see the command line scp -args /filepath/. However this requires that they be either logging all process activity or checking it at the time you are transferring. Additionally, if you are doing it from your own system at work to another system (say at home or elsewhere), they won't necessarily have that visibility.

Additionally, as @alex.forencich mentioned: It is also possible to log all system calls (including file open and read calls) so even if your copying program (scp, sftp, etc.) does not log or leak anything (command line arguments), it is still possible to figure out what files were read or written. See the linux audit system. –

Related Solutions

SSH Configuration – Can SSH Be Used Without SCP?

Apparently, it is possible (according to post #3 at that link). The trick is in the authorized_keys file format. There are several options that allow the server to restrict SSH features based on what key was used to authenticate. The "command=" option allows the server administrator to attach a restriction on the public key -- something like

"any incoming connections that authenticate with this key will execute this command, regardless of what command might have been requested by the user".

It might prevent the execution of standard SCP and SFTP, but if it provides an interactive shell there's probably a way around it:

$ ssh user@host 'cat /some/where/whatiwant.txt' > igotit.txt

Linux – SCP – “not a directory” – What am I doing wrong

Since you want to copy the file with the same name, you don't need to specify a target name:

scp ~/path/bla/ble/.bash_profile username@host.com:/home/bleble/

Because a .bash_profile exists in the target directory, scp thinks you are giving it a directory as a target, attempts to descend into to it and exits since it is not actually a directory.

Best Answer

Related Solutions

SSH Configuration – Can SSH Be Used Without SCP?

Linux – SCP – “not a directory” – What am I doing wrong

Related Question