SCP Problem

Since starting at MIT my support focus has been on the Linux and Solaris environments as opposed to Microsoft environments from my last position. Getting reacquainted with SSH, SSL and Apache has been fun and picking up Kerberos, PGP, GPG, and Oracle Application Server has been great. I wanted to share an SCP problem that I was having that had me stumped for a couple of days.

Our environments are locked down and for the most part individual accounts are restricted. We use Kerberos authentication for access to restricted accounts and because of this SCP is not a good solution to use directly between servers, as we do not have a full username and password access. What we do is push and pull files to a staging server, and then push or pull the files to the default location. I built a desktop running RedHat Enterprise Server 5.0 and was using this new environment as my staging server. I ran into a problem on the RedHat Enterprise Server when attempting to SCP to and from Solaris environments. I would receive the following error:

"scp bad packet length problem"

I could scp between all of my RedHat servers and all of my Ubuntu desktops however I could not push or pull to a Solaris server. After some research, the error appeared to be caused by different versions of ssh. I found a link on the openbsd.org site explaining all all ssh parameters . Here is the reference to the Protocol Parameter:

Protocol

Specifies the protocol versions ssh(1) should support in order of
preference. The possible values are `1' and `2'. Multiple ver-
sions must be comma-separated. The default is ``2,1''. This
means that ssh tries version 2 and falls back to version 1 if
version 2 is not available.

I looked at the ssh config files located in /etc/ssh and found the Protocol parameter in sshd_config. "Protocol 2,1" was commented out and "Protocol 2" was uncommented. I commented out the "Protocol 2", uncommented "Protocol 2,1" and restarted ssh "/etc/init.d/sshd restart".

This solved the problem.

Technorati : scp ssh RedHat

Comments

[Erek Dyskant]

Have you looked at using a version repository instead of an scp push/pull scheme?

Anyway, someone probably commented out version 1 because version 1 has some known security deficiencies.