The SSH protocol is facilitating multiple overlapping "services" of which file copying is one of them. The way the SSH protocol does this is by launching
scp -t as a child process on a server, when a client connects to it using the
scp command line tool.
Each server where SSH is installed requires a full compliment of CLI tools to provide all the "services" that are part of SSH (
sftp). There location on disk is only required by the managing
sshd server daemon. This means they can be in any location, the clients are not aware nor need to be, they're only communicating with
sshd via TCP port (typically 22) as client/server.
Applications such as
ssh itself are client/server applications. This means that they require both a client application
scp and a server application. In this case,
scp is both.
Here's an example
$ scp /Users/user1/thumbnails-digikam.db pi-hole:/tmp/.
thumbnails-digikam.db 0% 0 0.0KB/s --:-- ETA^Z
+ Stopped scp /Users/sammingolelli/thumbnails-digikam.db pi-hole:/tmp/.
I've started a
scp from my laptop to my Raspberry Pi server (pi-hole), and then paused it mid-stream via Ctrl+Z.
If I then
ssh to the Raspberry Pi server and do a
$ ps -eaf | grep [s]cp
pi 9688 6147 0 11:11 ? 00:00:00 scp -t /tmp/.
We can see that the application server
Rasberry Pi (server)
scp is running, and writing our file to
/tmp directory. We can see the file in this paused state being written as well:
$ ls -l /tmp/thumbnails-digikam.db
-rw-r--r-- 1 pi pi 2260992 Jul 6 11:12 /tmp/thumbnails-digikam.db
$ ls -l ~/thumbnails-digikam.db
-rw-r--r-- 1 user1 staff 38551552 Jun 4 00:47 /Users/user1/thumbnails-digikam.db
If we let the
scp continue by un-pausing it on the laptop (client):
scp /Users/user1/thumbnails-digikam.db pi-hole:/tmp/.
It'll finish and if we look again on the Raspberry Pi (server) you'll see that the
scp application is no longer running:
$ ps -eaf|grep [s]cp
OpenSSH is a bit unique in that it starts server applications (daemons) on demand just for the duration of a particular operation, and then once the transfer is complete, it terminates them.
The original daemon that's facilitating this is the
$ ps auxf | less
root 6132 0.0 0.6 11524 5812 ? Ss 02:53 0:00 \_ sshd: pi [priv]
pi 6147 0.0 0.4 11812 4016 ? S 02:53 0:03 \_ sshd: pi@pts/0
pi 6150 0.0 0.4 6172 4036 pts/0 Ss 02:53 0:00 \_ -bash
root 6172 0.0 0.3 7232 3336 pts/0 S 02:53 0:00 | \_ sudo -Es
root 6176 0.0 0.4 6120 4180 pts/0 S 02:53 0:00 | \_ /bin/bash
root 9772 0.0 0.3 7888 3076 pts/0 R+ 11:20 0:00 | \_ ps auxf
root 9773 0.0 0.0 3800 480 pts/0 S+ 11:20 0:00 | \_ less
pi 9745 0.2 0.1 3988 1872 ? Ss 11:19 0:00 \_ scp -t /tmp/.
Notice the parent/child hierarchy of
scp, it's a child process of
Anatomy of a
If you take a look at the OReilly SSH book there's a diagram that shows the mechanics of how
scp connections work.
In the diagram above, you can see that when the
scp <file> <server>:/<path> command is executed, it gets translated to something like this on the client side:
/usr/bin/ssh -x -oForwardAgent=no -oPermitLocalCommand=no -oClearAllForwardings=yes -- pi-hole scp -t /tmp/.
The client (
scp) in this case is directing the
sshd daemon on the client side to send a request to the server's
sshd telling it to launch
scp -t /tmp on the remote side.
Based on the documentation this is by design how
scp uses SSH's tunnel.
I did some experiments where I made a copy of the
scp binary to
myscp and then ran this on the client. In every instance, the
/usr/bin/ssh ... command still showed the
-- someserver scp -t /tmp/..
This leads me to believe that the name of the
scp executable, though referenced by the
scp client when the
ssh command is executed, does not get passed to the client directly. Rather the
sshd daemon has the names for the various client tools that it supports, hardcoded within it.
This is further backed up by the details shown in the able above.
It's not possible to completely remove/disable the definition of
--with-default-path when compiling
sshd. Removing it completely, breaks
sshd's ability to look for
scp -t <dir> when an
scp connection is triggered.
The best you can do to isolate
sshd would be to designate a directory, which only contains the various binaries that make up OpenSSH.