Prevent scp from overwriting existing files?

Question

Have been googling this for a while, and the problem is not so much of one where I trust my users to "do the right thing" and have them use rsync with various options to avoid overwriting files. I actually need to somehow have scp not overwrite existing files... rsync is not an option because there will be those who will use scp... so I need to deal with that.

I think it possible to modify the sshd code, so there would be one potential avenue to solve this.

Other than that, has anyone else cracked this nut and what was done? Wrappers?

Answer 1

This is a simple shell function (bash and ksh93) that wraps around scp. It will refuse to execute the real scp if the target file exists on the system.

function scp
{
    typeset argv="$@"
    typeset target="${argv[-1]}"

    if [[ -e "$target" ]]; then
        echo 'Target file exists, refusing to overwrite' >&2
        return 1
    fi

    command scp "$@"
}

The function picks out the target from the last command line argument, and then checks to see if it corresponds to an existing filename. If it does, it refuses to run scp, displaying a diagnostic message, and returns a non-zero exit status.

If there is no existing filename corresponding to the target, it goes ahead and calls the real scp with the original command line.

No attempt is made to distinguish between a transfer in one direction or the other. It will thus fail if there's a filename corresponding to the user@hostname:file-type format in the current directory.

If you have a list of protected filenames in a file (this should be a list of absolute pathnames, one per line, corresponding to the real path of each file as returned by the GNU coreutils utility realpath):

function scp
{
    typeset argv="$@"
    typeset target="${argv[-1]}"

    if grep -q -F -x "$( realpath "$target" )" protected_files.txt; then
        echo 'Target filename is protected, refusing to overwrite' >&2
        return 1
    fi

    command scp "$@"
}