Package: lftp
Version: 4.8.4-2+b1
Severity: normal

The "open" command does not initiate the connection, and it appears
impossible to do that. This makes lftp unusable with SimpleSSHD under
Android when a key hasn't been defined yet, for instance. There is
no such issue with sftp.

The problem is the following: when SimpleSSHD has just been installed,
there isn't a key yet. Thus, when one connects by sftp, SimpleSSHD
outputs a random, temporary password for security. The password is
provided only once one has initiated the connection (since it will
change at each connection). The problem with lftp is that when it
asks the password, it hasn't initiated the connection, so that one
does not know the password.

Note: If one gives a dummy password, lftp tries to connect, and
SimpleSSHD outputs the password that should have been used. But
after the login failure, lftp closes the connection, so that at
the next connection the password will change. Thus this does not
solve the problem.

Note: This method with the random, temporary password must be used
in order to upload the key in authorized_keys.

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500, 
'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.2.0-2-amd64 (SMP w/8 CPU cores)
Locale: LANG=POSIX, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=POSIX 
(charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages lftp depends on:
ii  libc6         2.29-1
ii  libgcc1       1:9.2.1-8
ii  libgnutls30   3.6.9-5
ii  libidn2-0     2.2.0-2
ii  libreadline8  8.0-3
ii  libstdc++6    9.2.1-8
ii  libtinfo6     6.1+20190803-1
ii  netbase       5.6
ii  zlib1g        1:1.2.11.dfsg-1+b1

Versions of packages lftp recommends:
ii  openssh-client [ssh-client]  1:8.0p1-6

lftp suggests no packages.

-- no debconf information

Reply via email to