So tell me. Do you think #curl should support plain SSH:// URLs to execute commands remotely?
16
Replies
2
Boosts
@bagder I mean, It's inevitable. Isn't it? 😉
@bagder No.
Even less so when it's slop.
@bagder Unless it requires command line arguments to indicate this is not a pure document request, no. Just like a GET should not act as a POST, buy 1000000x worse.
Also where would it be getting the credentials? Would curl/libcurl snoop your .ssh??
@dalias curl already does SCP and SFTP with credentials, so that's not really a new problem. But yeah, I don't feel that SSH has a good story for curl.
@bagder Nah, just sounds like another cluster of problems.
Initial instinct says no, it feels like feature creep. Not SSH itself (as it does SFTP already), but the command execution part.
I feel like there is little to gain here, other tools already do this and it just increases maintenance scope and security risks
@bagder initial thought: "nooooooooooooooooooo....!!!!"
Second thought: probably not :p
@bagder Nope. There's already a command for that.
Interesting, yes. But i do not. Next to the very good reasons already mentioned here, i am also missing a convincing motivation behind this.
@bagder just the other day I was joking whether curl can be used as a transport for ssh ProxyCommand…
@bagder Ww have SCP and SFTP. ... why we need more?
@bagder i get the feeling that this could be used for some nasty things. Or at least that or at least that this could make RCE easier in some setups where curl ist invoked with a user-supplied URL
This comment is unavailable — it may have been deleted or is not visible to you.
@bagder for me, that sounds like introducing a new kind of command line injection🫣
@bagder how is it different from https://example.com/execute.api/shutdown%20-h%20now ? :)
but now: “ssh://host.example.com/command=shutdown -h now” instead of passing it with a custom -X
SSH is the transport in this case in stead of HTTPS. But otherwise, it is a ‘URL" that is requested.
For a command like “ps aux" it would make more sense in a way, as then you got a question and an answer (in plain/text or if there is a tool like ‘jq' with json mode).
You would have to come up with a proper SSH URL scheme though. But if one would do that it would fit curl better, yet another special option not so much.
