A run through the server logs turned this up:
Nov 30 15:19:02 lemongrab sshd[8121]: subsystem request for sftp by user root failed, subsystem not found
Which makes sense since I don't use sftp, but why is scp
trying to use it all of a sudden?
Apparently the SCP protocol has been deprecated in favour of SFTP in OpenSSH 9.0, which Apple provides in Ventura. man scp
gave me the answer: use the -O
(capital letter o, not zero) option, which presumably wasn't present in the previous version.
-O Use the legacy SCP protocol for file transfers instead of the SFTP protocol.
Forcing the use of the SCP protocol may be necessary for servers that
do not implement SFTP, for backwards-compatibility for particular
filename wildcard patterns and for expanding paths with a ‘~’ prefix for
older SFTP servers.
That's just a temporary workaround, of course. As a sysadmin I don't want to use deprecated protocols, especially when they involve encryption or security. The correct solution is to add this to sshd_config
on the server side, if you're in a position to do so:
Subsystem sftp internal-sftp
And then not use -O
on the client side. (Note this has some minor side effects related to remote shell path expansions when using the scp
utility.)