--- title: SFTP: a More Secure Successor to SCP | daily.dev description: SCP, the widely used file-copy protocol built on SSH, inherits insecure design from the 1983-era RCP protocol and has suffered real vulnerabilities, including... canonical: https://daily.dev/posts/sftp-a-more-secure-successor-to-scp-igtp73gq1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SFTP: a More Secure Successor to SCP | daily.dev og:description: SCP, the widely used file-copy protocol built on SSH, inherits insecure design from the 1983-era RCP protocol and has suffered real vulnerabilities, including... og:url: https://daily.dev/posts/sftp-a-more-secure-successor-to-scp-igtp73gq1 og:image: https://api.daily.dev/og/posts/IGTp73GQ1.png og:image:alt: SFTP: a More Secure Successor to SCP og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SFTP: a More Secure Successor to SCP **[Teleport](https://daily.dev/sources/teleport)** · 12 min read · 0 upvotes · 0 comments ## Summary SCP, the widely used file-copy protocol built on SSH, inherits insecure design from the 1983-era RCP protocol and has suffered real vulnerabilities, including a 2019 F-Secure advisory allowing malicious servers to overwrite files and spoof output, and CVE-2020-15778, a command injection bug. OpenSSH's maintainers acknowledged the problems but declined to fix them outright, instead pushing users toward SFTP. SFTP uses a modern client-server request-response model, supports extensions, richer auditing, and use cases beyond file transfer (like SSHFS mounting). OpenSSH added SFTP support to the scp command itself, and as of OpenSSH 9.0.0, SFTP is the default transfer protocol instead of the legacy SCP protocol. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did OpenSSH deprecate the scp command in favor of sftp? OpenSSH declared scp deprecated after CVE-2020-15778, a command injection vulnerability discovered by Chinmay Pandya in 2020, where a specially crafted target filename could execute arbitrary commands. Because scp's argument-passing design inherited from the 1983 RCP protocol made the flaw very hard to fix without breaking existing workflows, OpenSSH pushed users toward sftp instead of patching scp's underlying model. _daily.dev helps engineers track protocol deprecations like scp before they get burned in production._ ### As of which OpenSSH version does the scp command use SFTP by default instead of the SCP protocol? Starting with OpenSSH version 9.0.0, SFTP became the default protocol used by the scp command instead of the legacy SCP protocol. Previously, a contributor named Jakub Jelen added SFTP support to scp in 2020 as an opt-in feature enabled with the -s flag, letting users keep familiar scp syntax while benefiting from SFTP's more secure request-response design. _developers upgrading SSH tooling can follow changes like this via daily.dev to avoid surprises after an OpenSSH upgrade._ ### What was the impact of the 2019 SCP client vulnerabilities found by Harry Sintonen? A malicious SCP server could write arbitrary files into the client's target directory, change that directory's permissions, and spoof the client's output to hide the extra file operations. This could let an attacker add a rogue user, overwrite authorized SSH keys, or truncate log files depending on what directory the victim specified. Sintonen's own recommended mitigation was to switch to SFTP wherever possible. _teams choosing secure file-transfer tools can compare protocol trade-offs like this on daily.dev._ ## Similar posts on daily.dev - [SCP for Data Exfiltration on Pentests](https://daily.dev/posts/scp-for-data-exfiltration-on-pentests-fzpfx5zlw) · InfoSec Write-ups · 0 upvotes · 0 comments - [Linux Fu: Improving FTP](https://daily.dev/posts/linux-fu-improving-ftp-zanumd21y) · Hackaday · 0 upvotes · 0 comments - [OpenSSH 10.3 released](https://daily.dev/posts/openssh-10-3-released-krgsb6m3v) · LWN.net · 0 upvotes · 0 comments - [SFTP With JSch](https://daily.dev/posts/sftp-with-jsch-elshbamke) · Baeldung · 2 upvotes · 0 comments - [Blog](https://daily.dev/posts/blog-ko5hcgqs8) · Lobsters · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/sftp-a-more-secure-successor-to-scp-igtp73gq1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SFTP: a More Secure Successor to SCP","url":"https://daily.dev/posts/sftp-a-more-secure-successor-to-scp-igtp73gq1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sftp-a-more-secure-successor-to-scp-igtp73gq1"},"datePublished":"2026-08-23T12:22:55.054Z","dateModified":"2026-08-23T12:44:47.368Z","description":"SCP, the widely used file-copy protocol built on SSH, inherits insecure design from the 1983-era RCP protocol and has suffered real vulnerabilities, including...","image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","thumbnailUrl":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sftp-a-more-secure-successor-to-scp-igtp73gq1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ssh","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"SFTP: a More Secure Successor to SCP"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/sftp-a-more-secure-successor-to-scp-igtp73gq1#faq","mainEntity":[{"@type":"Question","name":"Why did OpenSSH deprecate the scp command in favor of sftp?","acceptedAnswer":{"@type":"Answer","text":"OpenSSH declared scp deprecated after CVE-2020-15778, a command injection vulnerability discovered by Chinmay Pandya in 2020, where a specially crafted target filename could execute arbitrary commands. Because scp's argument-passing design inherited from the 1983 RCP protocol made the flaw very hard to fix without breaking existing workflows, OpenSSH pushed users toward sftp instead of patching scp's underlying model. daily.dev helps engineers track protocol deprecations like scp before they get burned in production."}},{"@type":"Question","name":"As of which OpenSSH version does the scp command use SFTP by default instead of the SCP protocol?","acceptedAnswer":{"@type":"Answer","text":"Starting with OpenSSH version 9.0.0, SFTP became the default protocol used by the scp command instead of the legacy SCP protocol. Previously, a contributor named Jakub Jelen added SFTP support to scp in 2020 as an opt-in feature enabled with the -s flag, letting users keep familiar scp syntax while benefiting from SFTP's more secure request-response design. developers upgrading SSH tooling can follow changes like this via daily.dev to avoid surprises after an OpenSSH upgrade."}},{"@type":"Question","name":"What was the impact of the 2019 SCP client vulnerabilities found by Harry Sintonen?","acceptedAnswer":{"@type":"Answer","text":"A malicious SCP server could write arbitrary files into the client's target directory, change that directory's permissions, and spoof the client's output to hide the extra file operations. This could let an attacker add a rogue user, overwrite authorized SSH keys, or truncate log files depending on what directory the victim specified. Sintonen's own recommended mitigation was to switch to SFTP wherever possible. teams choosing secure file-transfer tools can compare protocol trade-offs like this on daily.dev."}}]} ```