So far, we’ve described the syntax of scp only in general: [2.2.1]

    scp name-of-source name-of-destination

Each of the two names, or path specifications, on the command line represents files or directories in the following manner (it is fairly consistent with the behavior of Unix cp or rcp):

Both name-of-source and name-of-destination may have the following form from left to right:

Although each field is optional, you can’t omit them all at the same time, yielding the empty string. Either the hostname (•) or the directory path (•) must be present. Some examples:

Here are a few complete examples:

    $ scp myfile myfile2                   A local copy just like cp
    $ scp myfile bob@host1:                Copy . /myfile to ~bob on host1
    $ scp bob@host1:myfile .               Copy ~bob/myfile on host1 to . /myfile
    $ scp host1:file1 host2:file2          Copy file1 from host1 to file2 on host2
    $ scp bob@host1:file1 jen@host2:file2  Same as above, but copying from bob's to jen's account

Table 7-3 summarizes the syntax of an scp path.

scp for OpenSSH has no special support for wildcards in filenames. It simply lets the shell expand them:

    $ scp *.txt server.example.com:

Watch out for wildcards in remote file specifications, as they are evaluated on the local machine, not the remote. For example, this attempt is likely to fail:

    $ scp server.example.com:*.txt .         Bad idea!

The Unix shell attempts to expand the wildcard before scp is invoked, but the current directory contains no filename matching “server.example.com:*.txt”. The C shell and its derivatives will report “no match” and will not execute scp. Bourne-style shells, noticing no match in the current directory, will pass the unexpanded wildcard to scp, and the copy may succeed as planned, but this coincidental behavior shouldn’t be relied on. Always escape your wildcards so that they are explicitly ignored by the shell and are passed to scp:

    $ scp server.example.com:\*.txt .

Tectia’s scp does its own regular expression matching after shell-wildcard expansion is complete. The sshregex manpage for Tectia (see Appendix B) describes the supported operators. Even so, escape your wildcard characters if you want your local shell to leave them alone.

Sometimes you want to copy not just a single file, but a directory hierarchy. In this case, use the -r option, which stands for recursive. For example, to securely copy the directory /usr/local/bin and all its files and subdirectories to another machine:

    $ scp -r /usr/local/bin server.example.com:

If you forget the -r option when copying directories, scp complains:

    $ scp /usr/local/bin server.example.com:
    /usr/local/bin: not a regular file

Although scp can copy directories, it isn’t necessarily the best method. If your directory contains hard links or soft links, they won’t be duplicated. Links are copied as plain files (the link targets). Other types of special files, such as named pipes, also aren’t copied correctly.^[116] A better solution is to use tar, which handles special files correctly, and send it to the remote machine to be untarred, via SSH:

    $ tar cf - /usr/local/bin | ssh server.example.com tar xf -

or rsync, tunneled through SSH:

    $ rsync -e ssh /usr/local/bin server.example.com:

When scp copies files, the destination files are created with certain file attributes. By default, the file permissions adhere to a umask on the destination host, and the modification and last access times will be the time of the copy. Alternatively, you can tell scp to duplicate the permissions and timestamps of the original files. The -p option accomplishes this:

    $ scp -p myfile server.example.com:

For example, if you transfer your entire home directory to a remote machine, you probably want to keep the file attributes the same as the original:

    $ scp -rp $HOME server.example.com:myhome/

Again, scp does not duplicate special files and links, so consider tar or rsync -a instead:

    $ rsync -a -e ssh /usr/local/bin server.example.com:

After copying a file, Tectia’s scp can optionally remove the original if desired. The -u command-line option specifies this:

    # Tectia
    $ scp myfile server.example.com:
    $ ls myfile
    myfile
    $ scp -u myfile server.example.com:
    $ ls myfile
    myfile: No such file or directory

If you’ve ever wanted a “secure move” command in addition to secure copy, you can define one in terms of scp -u:

    # Tectia
    $ alias smv='scp -u'

Tectia’s scp has several features to protect you from running dangerous commands.

    $ scp myfile server.example.com:mydir
    $ rm myfile

    # Tectia
    $ scp -d myfile server.example.com:mydir
    scp: warning: Destination (example.com:mydir) is not a directory.

    # Tectia
    $ scp -n myfile server.example.com:
    Not transferring myfile -> server.example.com:./myfile  (1k)

    # Tectia
    $ scp -I myfile server.example.com:
    Overwrite destination file './myfile' with '/home/smith/myfile' (yes/yes to all/no/no
    to all/abort) [y/Y/n/N/a]:n

    # Tectia
    $ scp --overwrite yes myfile server.example.com:   Always overwrite

If you’re using scp in scripts with passwordless authentication [11.1], you might want to suppress all prompting of the user. That’s what the -B option is for, which enables batch mode. When present, this option suppresses all interaction with the user. [7.4.6.4]

    $ scp -B myfile server.example.com:

OpenSSH provides the -i option for scp, as it does for ssh, to specify a particular identity file for authentication. [7.4.2]

    # OpenSSH
    $ scp -i my_favorite_key myfile server.example.com:

Tectia has no option like this, but you can get around this limitation with - o: [7.1.2.1]

    # Tectia
    $ scp -o "IdentityFile my_identity_file" myfile server.example.com:

You can downgrade scp to use the SSH-1 protocol with the -1 option, if you are feeling insecure:

    $ scp -1 myfile server.example.com:

or redundantly specify the SSH-2 protocol, which is the default anyway:

    # OpenSSH
    $ scp -2 myfile server.example.com:

You can specify the remote TCP port contacted by scp with the -P option (OpenSSH):

    # OpenSSH
    $ scp -P 23456 myfile server.example.com:

or by appending a hash mark and port number to the file specification (Tectia):

    # Tectia
    $ scp myfile server.example.com#23456:

Both OpenSSH and Tectia can require the use of IP Version 4 or 6, as ssh does, with the -4 and -6 options. [7.4.5.6]

You can set the encryption cipher for scp with the -c option, exactly as for ssh. [7.4.9]

The -l (lowercase L) option of OpenSSH’s scp command will limit the bandwidth of the connection, in case you want to avoid saturating a slower network.

    # OpenSSH
    $ scp -l 1000 myfile server.example.com:      Limit bandwidth to 1000 kilobits per second

Tectia’s scp command can limit the maximum number of concurrent requests it will issue, with the -N option:

    # Tectia
    $ scp -r -N 5 mydirectory server.example.com:   Limit to five concurrent requests in this recursive directory transfer

Finally, Tectia’s -b option controls the buffer size for the file transfer; the default is 32K:

    # Tectia
    $ scp -b 65536 myfile server.example.com: Set buffer size to 64K

OpenSSH’s scp command can compress the data before sending it, with the -C option, to speed up transfers: [7.4.14]

    # OpenSSH
    $ scp -C myfile server.example.com:

Tectia does not provide a similar option, but you can get around this and enable compression with -o: [7.1.2.1]

    $ scp -o "Compression yes" myfile server.example.com:

Tectia’s scp has several options for changing the files in transit. It can change the destination filenames to all lowercase, with the --force-lower-case option:

    # Tectia
    $ scp --force-lower-case MyFile server.example.com:

The destination file on server.example.com will be named myfile rather than MyFile.

Another Tectia transformation involves the treatment of lines in a text file. scp normally transfers files literally, as binary data. You can choose to treat the files specially as text files—that is, lines of ASCII characters terminated by carriage returns and/or linefeeds—with the -a option. Unix, DOS, and Macintosh operating systems use different standards for terminating lines of text, and scp can convert between these standards.

    # Tectia
    $ scp -a my_text_file server.example.com:

The above command assumes that the SSH client and server can accurately communicate and agree upon the text file standards. If not, you can use a more advanced syntax for -a that specifies the line terminators as unix, dos, or mac. This is done by placing src: (for the source machine) and dst: (for the destination machine) after the -a option. Some examples:

    # Tectia
    $ scp -asrc:unix -adst:dos myfile server.example.com:  Convert from Unix to DOS/Windows format
    $ scp -asrc:dos -adst:mac myfile server.example.com:   Convert from DOS/Windows to Macintosh format
    $ scp -asrc:mac -adst:unix myfile server.example.com:  Convert from Macintosh to Unix format

Tectia’s scp does a few optimizations to avoid transferring unnecessary files and data. Before coping a file, scp compares the file sizes. If they are different, the copy commences, but if they are the same, scp computes an MD5 checksum of the source and destination file. If the checksums are equal, the files are assumed to be identical and no copy takes place, and you’ll see a message like this:

    myfile: complete md5 match -> transfer skipped

If you always want your files copied, even if they are identical (i.e., have equal checksums), you can disable the MD5 test with the --checksum option, providing the value no:

    # Tectia
    $ scp --checksum no myfile server.example.com:   Don't compute checksums for files

Tectia’s scp performs similar checking on individual data blocks to determine whether to transfer them or not. You can control this with the -W or --whole-file options, providing the value yes or no:

    # Tectia
    $ scp --whole-file yes myfile server.example.com:   Always transfer whole files

As scp copies files, it prints information about its progress, including statistics about the file transfer. You can control this information with various options.

OpenSSH simply lets you suppress the statistics with its -q option:

    # OpenSSH
    $ scp -q myfile server.example.com:

Tectia can likewise suppress statistics with the -Q option (Tectia).

    # Tectia
    $ scp -Q myfile server.example.com:

but permits more control with the --statistics option:

    # Tectia
    $ scp --statistics no myfile server.example.com:   Same as -Q option

    $ scp --statistics simple myfile server.example.com:  Minimal statistics
    /home/smith/myfile |    4B |    4B/s | TOC: 00:00:01

    $ scp --statistics yes myfile server.example.com:  Full statistics
    myfile                                     |    4B |    4B/s | TOC: 00:00:01 | 100%

To copy files securely, scp invokes ssh internally. Therefore, scp needs to know where the ssh executable resides on disk. Normally, the path to ssh is made known to scp at compile time (by the compile-time flag --prefix), but you can specify the path manually if you like. [4.3.5.1] For instance, you can test a new version of ssh with an old version of scp. The command-line option -S specifies the path:

    $ scp -S /usr/alternative/bin/ssh myfile server.example.com:

Both OpenSSH and Tectia scp will print a usage message briefly describing all its options:

    $ scp --help

You can get the same effect if you omit all arguments (OpenSSH) or use -h (Tectia). Tectia will also print its version number on request:

    # Tectia
    $ scp --version
    $ scp -V

scp for OpenSSH has two undocumented options, -t and -f, for internal use. Most likely you will never need to use them explicitly. They inform scp of the direction of the copy: from the local to the remote machine, or from remote to local. The -t option means copying to a remote machine and -f means copying from a remote machine.

Whenever you invoke scp, it invisibly runs a second scp process on the remote host that includes either -t or -f on its command line. You can see this if you run scp in verbose mode. If copying from the local to the remote machine, you see:

    $ scp -v myfile server.example.com:
    Executing: host server.example.com, ..., command scp -v -t .
    ...

On the other hand, if you copy from the remote to the local machine, you see:

    $ scp -v server.example.com:myfile .
    Executing: host server.example.com, ..., command scp -v -f .
    ...

Again, it’s likely you’ll never use these options, but they’re useful to know when reading scp’s output in verbose mode.

You can set any client configuration keywords for scp using the -o option, exactly as for ssh. Additionally, OpenSSH lets you specify an alternative configuration file with -F. [7.1.2.1]