Could anyone help explain the parameters in the following SFTP command please?


This was used as part of the LFTP command of the source.

What is the xx after the first :? Is that the directory (couldn't find any such directory on the sever of this user)?


It's where the password for user@test.com gets put in the command, although this is not a recommended approach for sftp.

  • Thanks Dave. That's exactly what I'm after. We are trying to make sense of this and improve the way how this is done. Appreciated.
    – Moon
    Jul 26 at 1:26

What you really want to understand is the URI syntax. Note that a URI (You-Are-Eye) is NOT the same as a URL (You-Are-Ell). All URL's are URI's, but not all URI's are URL's.

Please see the Wiki article https://wikipedia.org/wiki/Uniform_Resource_Identifier or the IETF RFC https://datatracker.ietf.org/doc/html/rfc3986 about URI's.

In general, for a sftp URI (in this case, the same as a URL), the format is:

"sftp:" [ "//" [ <user-part> "@" ] <host-part> ] <path-part>

Where the <user-part> can be further sub-divided:

<user-name> [ ":" <user-password> ]

In general, however, using such a URI/URL is strongly discouraged, as both the user name and password are plainly visible to anyone snooping network traffic outside of the secured end points. That "window of opportunity" may be very small in a well-written application, or it may be comparatively large if the application "hands it off" to another application to handle the establishing the actual secure connection between end points.

  • 1
    Worse, if you're particularly careless it might be visible with ps by any other logged-in user.
    – Shadur
    Jul 26 at 8:24
  • 1
    Strictly speaking, because SFTP never sends the URI over the wire, there is no issue with the password leaking to the network. The problem is it leaking to other users on the same system, because it’s trivial on most systems to see the command-line arguments of each command running on the system, and having it in the command line means it’s persistent in memory (whereas just specifying it interactively will only have it in memory long enough to authenticate). Jul 26 at 11:50
  • 4
    Yes and no. "Strictly speaking" is correct. I have, however, seen local network setups where navigating a LAN firewall and reverse proxy ends up forwarding (and caching!) the URL. The risk is minimal, since it (should) never be sent out to the rest of the Internet, but a minimal risk is still a risk... And I learned long ago, all the "should (not)" things in life, will happen, no matter what you do.
    – C. M.
    Jul 26 at 12:53
  • Thanks for the detailed explanation guys. I learnt something new today.
    – Moon
    Jul 27 at 9:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.