Bug ID 819429: Unable to scp to device after upgrade: path not allowed

Last Modified: Sep 14, 2020

Bug Tracker

Affected Product:  See more info
BIG-IP LTM(all modules)

Known Affected Versions:
13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4, 13.1.1.5, 13.1.3, 13.1.3.1, 13.1.3.2, 13.1.3.3, 13.1.3.4, 14.0.0, 14.0.0.1, 14.0.0.2, 14.0.0.3, 14.0.0.4, 14.0.0.5, 14.0.1, 14.0.1.1, 14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 14.1.2.3, 14.1.2.4, 14.1.2.5, 14.1.2.6, 14.1.2.7, 15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.0.1.4, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5

Fixed In:
16.0.0

Opened: Aug 30, 2019
Severity: 4-Minor

Symptoms

Cannot scp copy a file to the BIG-IP system. The system reports an error: path not allowed

Impact

Cannot copy files to a path present under whitelist.

Conditions

Issue occurs when both conditions are present: -- The BIG-IP user has 'shell tmsh' or 'shell none' access. -- The scp destination is the real path target (not listed in the 'allow' list) of a symbolic link that is listed in the scp 'allow' list (/config/ssh/scp.whitelist). For example: scp to /var/tmp succeeds. scp to /shared/tmp fails with 'path not allowed'.

Workaround

Use the explicitly listed (symlink) path as the scp destination.

Fix Information

You can now scp copy files to a path present under whitelist without error.

Behavior Change