5d089cb
diff --git a/scp.1 b/scp.1
5d089cb
index 68aac04b..a96e95ad 100644
5d089cb
--- a/scp.1
5d089cb
+++ b/scp.1
5d089cb
@@ -8,9 +8,9 @@
5d089cb
 .\"
5d089cb
 .\" Created: Sun May  7 00:14:37 1995 ylo
5d089cb
 .\"
5d089cb
-.\" $OpenBSD: scp.1,v 1.100 2021/08/11 14:07:54 naddy Exp $
5d089cb
+.\" $OpenBSD: scp.1,v 1.101 2021/09/08 23:31:39 djm Exp $
5d089cb
 .\"
5d089cb
-.Dd $Mdocdate: August 11 2021 $
5d089cb
+.Dd $Mdocdate: September 8 2021 $
5d089cb
 .Dt SCP 1
5d089cb
 .Os
5d089cb
 .Sh NAME
5d089cb
@@ -18,7 +18,7 @@
5d089cb
 .Nd OpenSSH secure file copy
5d089cb
 .Sh SYNOPSIS
5d089cb
 .Nm scp
5d089cb
-.Op Fl 346ABCOpqRrsTv
5d089cb
+.Op Fl 346ABCOpqRrTv
5d089cb
 .Op Fl c Ar cipher
5d089cb
 .Op Fl D Ar sftp_server_path
5d089cb
 .Op Fl F Ar ssh_config
5d089cb
@@ -37,9 +37,6 @@ It uses
5d089cb
 .Xr ssh 1
5d089cb
 for data transfer, and uses the same authentication and provides the
5d089cb
 same security as a login session.
5d089cb
-The scp protocol requires execution of the remote user's shell to perform
5d089cb
-.Xr glob 3
5d089cb
-pattern matching.
5d089cb
 .Pp
5d089cb
 .Nm
5d089cb
 will ask for passwords or passphrases if they are needed for
5d089cb
@@ -79,7 +76,9 @@ The options are as follows:
5d089cb
 Copies between two remote hosts are transferred through the local host.
5d089cb
 Without this option the data is copied directly between the two remote
5d089cb
 hosts.
5d089cb
-Note that, when using the legacy SCP protocol (the default), this option
5d089cb
+Note that, when using the legacy SCP protocol (via the
5d089cb
+.Fl O
5d089cb
+flag), this option
5d089cb
 selects batch mode for the second host as
5d089cb
 .Nm
5d089cb
 cannot ask for passwords or passphrases for both hosts.
5d089cb
@@ -146,9 +145,10 @@ Limits the used bandwidth, specified in Kbit/s.
5d089cb
 .It Fl O
5d089cb
 Use the legacy SCP protocol for file transfers instead of the SFTP protocol.
5d089cb
 Forcing the use of the SCP protocol may be necessary for servers that do
5d089cb
-not implement SFTP or for backwards-compatibility for particular filename
5d089cb
-wildcard patterns.
5d089cb
-This mode is the default.
5d089cb
+not implement SFTP, for backwards-compatibility for particular filename
5d089cb
+wildcard patterns and for expanding paths with a
5d089cb
+.Sq ~
5d089cb
+prefix for older SFTP servers.
5d089cb
 .It Fl o Ar ssh_option
5d089cb
 Can be used to pass options to
5d089cb
 .Nm ssh
5d089cb
@@ -258,16 +258,6 @@ to use for the encrypted connection.
5d089cb
 The program must understand
5d089cb
 .Xr ssh 1
5d089cb
 options.
5d089cb
-.It Fl s
5d089cb
-Use the SFTP protocol for file transfers instead of the legacy SCP protocol.
5d089cb
-Using SFTP avoids invoking a shell on the remote side and provides
5d089cb
-more predictable filename handling, as the SCP protocol
5d089cb
-relied on the remote shell for expanding
5d089cb
-.Xr glob 3
5d089cb
-wildcards.
5d089cb
-.Pp
5d089cb
-A near-future release of OpenSSH will make the SFTP protocol the default.
5d089cb
-This option will be deleted before the end of 2022.
5d089cb
 .It Fl T
5d089cb
 Disable strict filename checking.
5d089cb
 By default when copying files from a remote host to a local directory
5d089cb
@@ -299,11 +289,23 @@ debugging connection, authentication, and configuration problems.
5d089cb
 .Xr ssh_config 5 ,
5d089cb
 .Xr sftp-server 8 ,
5d089cb
 .Xr sshd 8
5d089cb
+.Sh CAVEATS
5d089cb
+The original scp protocol (selected by the
5d089cb
+.Fl O
5d089cb
+flag) requires execution of the remote user's shell to perform
5d089cb
+.Xr glob 3
5d089cb
+pattern matching.
5d089cb
+This requires careful quoting of any characters that have special meaning to
5d089cb
+the remote shell, such as quote characters.
5d089cb
 .Sh HISTORY
5d089cb
 .Nm
5d089cb
 is based on the rcp program in
5d089cb
 .Bx
5d089cb
 source code from the Regents of the University of California.
5d089cb
+.Pp
5d089cb
+Since OpenSSH 8.8 (8.7 in Red Hat/Fedora builds),
5d089cb
+.Nm
5d089cb
+has use the SFTP protocol for transfers by default.
5d089cb
 .Sh AUTHORS
5d089cb
 .An Timo Rinne Aq Mt tri@iki.fi
5d089cb
 .An Tatu Ylonen Aq Mt ylo@cs.hut.fi
5d089cb
diff --git a/scp.c b/scp.c
5d089cb
index e039350c..c7cf7529 100644
5d089cb
--- a/scp.c
5d089cb
+++ b/scp.c
5d089cb
@@ -1,4 +1,4 @@
5d089cb
-/* $OpenBSD: scp.c,v 1.232 2021/08/11 14:07:54 naddy Exp $ */
5d089cb
+/* $OpenBSD: scp.c,v 1.233 2021/09/08 23:31:39 djm Exp $ */
5d089cb
 /*
5d089cb
  * scp - secure remote copy.  This is basically patched BSD rcp which
5d089cb
  * uses ssh to do the data transfer (instead of using rcmd).
5d089cb
@@ -448,7 +448,7 @@ main(int argc, char **argv)
5d089cb
 	const char *errstr;
5d089cb
 	extern char *optarg;
5d089cb
 	extern int optind;
5d089cb
-	enum scp_mode_e mode = MODE_SCP;
5d089cb
+	enum scp_mode_e mode = MODE_SFTP;
5d089cb
 	char *sftp_direct = NULL;
5d089cb
 
5d089cb
 	/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
5d089cb
@@ -1983,7 +1983,7 @@ void
5d089cb
 usage(void)
5d089cb
 {
5d089cb
 	(void) fprintf(stderr,
5d089cb
-	    "usage: scp [-346ABCOpqRrsTv] [-c cipher] [-D sftp_server_path] [-F ssh_config]\n"
5d089cb
+	    "usage: scp [-346ABCOpqRrTv] [-c cipher] [-D sftp_server_path] [-F ssh_config]\n"
5d089cb
 	    "           [-i identity_file] [-J destination] [-l limit]\n"
5d089cb
 	    "           [-o ssh_option] [-P port] [-S program] source ... target\n");
5d089cb
 	exit(1);