Support for handling scp -t upload command in custom Paramiko SSH server (honeypot)

Are you using paramiko as a client or server?

Server

What feature(s) aren't working right?

Something else

What version(s) of paramiko are you using?

3.5.1

What version(s) of Python are you using?

3.13.2

What operating system and version are you using?

MacOS Sonoma

If you're connecting as a client, which SSH server are you connecting to?

No response

If you're using paramiko as part of another tool, which tool/version?

No response

What are you trying to do with paramiko?

I'm implementing an SSH honeypot using Paramiko's ServerInterface, and trying to support SCP uploads from clients. The client runs:

scp file.txt user@host:/uploaded.txt

This results in the command scp -t /uploaded.txt being sent over an SSH channel.

I want to handle this SCP upload properly and extract the uploaded file content on the server side.

How are you trying to do it, and what's happening instead?

In my server’s check_channel_exec_request, I detect the scp -t command and then send an initial \x00 null byte to acknowledge, as required by the SCP protocol.

if command.startswith("scp -t"):
    channel.sendall(b"\x00")  # Acknowledge
    # wait for header...

But the client (using SCPClient from the scp package) times out after this step with:

SSHException: Channel closed
Meanwhile, on the server side, I see:

Detected SCP upload request
Sent initial null byte to acknowledge SCP -t
ERROR - SCP upload timed out: Timeout waiting for SCP header.

I think Paramiko is rejecting the session or closing the channel after the initial acknowledgment, possibly due to how exec channels are handled.

Anything else?

I’d appreciate any working server-side example (or guidance) that shows how to correctly implement the server logic to handle SCP uploads (scp -t) using Paramiko.

Let me know if you need logs or test cases — I’ve also confirmed that the initial exec_command reaches the server correctly.

Start at the ServerInterface check_channel_exec_request entry point and trace how the scp -t command, channel.sendall acknowledgment, and subsequent channel reads are handled. Use SCPClient as the client-side reproduction and verify that the server receives the SCP header and file content; done means an upload completes without the channel closing or timing out.