Transfer Files Securely with SCP: A Practical Guide
SCP (Secure Copy Protocol) lets you transfer files between computers over SSH, encrypting both the data and authentication in transit. You use it from the command line by specifying the source and destination paths, and it works on Linux, macOS, and Windows (via OpenSSH). This guide covers the essentials of using SCP, including syntax, options, common pitfalls, and secure alternatives.
What Is SCP and How Does It Work?
SCP is a file transfer protocol that runs over SSH (Secure Shell). It was introduced in the 1980s as part of the BSD Unix distribution and is now widely available through the OpenSSH suite. When you issue an SCP command, it establishes an SSH connection to the remote host, authenticates you (using a password or key), and then copies the files through that encrypted channel. This means your data and your login credentials are protected from eavesdropping on the network.
SCP is not a separate daemon; it uses the same SSH server (sshd) that already runs on most Unix-like systems. This makes it convenient because you don’t need to install additional software—just SSH.
Basic SCP Syntax and Examples
The general syntax is:
scp [options] source destination
Both source and destination can be local paths or remote paths in the form user@host:path. Here are common examples:
- Copy a local file to a remote server:
scp file.txt user@example.com:/home/user/ - Copy a remote file to your local machine:
scp user@example.com:/home/user/file.txt . - Copy a directory recursively:
scp -r myfolder user@example.com:/home/user/ - Copy between two remote hosts:
scp user1@host1:/path/file user2@host2:/path/
If you omit the username, SCP uses your current local username. If you omit the path after the colon, it uses the remote user’s home directory.
Choosing the Right Options
SCP has several useful options that control behavior:
-P port– Specifies the SSH port (capital P, unlike ssh’s lowercase -p). Default is 22.-i identity_file– Uses a specific private key for authentication.-r– Recursively copies directories.-p– Preserves modification times, access times, and modes from the original file.-q– Quiet mode; suppresses the progress meter and non-error messages.-C– Enables compression, which can speed up transfers of text files over slow links.-v– Verbose mode; prints debugging messages, useful for troubleshooting.
For example, to copy a directory to a server on port 2222 while preserving file attributes, you would run:
scp -r -P 2222 -p myfolder user@example.com:/backups/
Common Problems and How to Fix Them
Here are typical issues users encounter and their solutions:
- “Permission denied� – Check that your username and password/key are correct. Ensure the remote directory is writable by your user.
- “Connection refused� – The SSH server may not be running or a firewall is blocking port 22. Try a different port with
-P. - “Host key verification failed� – The remote host’s key has changed or is unknown. This can happen after a server reinstall. You may need to remove the old key from your
known_hostsfile (with caution). - Slow transfers – Use
-Cfor compression, or check your network latency. For many small files, consider archiving them first withtarand then transferring a single file. - Filename with spaces – Escape spaces with backslashes or quote the path, e.g.,
scp "my file.txt" user@host:.
SCP vs. SFTP vs. rsync: Which Should You Use?
SCP is simple and widely supported, but it has limitations. SFTP (SSH File Transfer Protocol) is a more modern protocol that also runs over SSH and supports interactive commands, resuming interrupted transfers, and directory listing. Many consider SFTP more secure because it can be restricted more easily and is not deprecated. rsync is a powerful tool for syncing directories, offering incremental transfers and checksum verification, but it requires rsync installed on both ends.
For one-off transfers, SCP is fine. For frequent or large transfers, SFTP or rsync may be better. Note that OpenSSH has deprecated SCP in favor of SFTP in recent versions, but SCP still works for most users.
Security Considerations and Best Practices
SCP is only as secure as your SSH setup. Follow these practices:
- Use SSH keys instead of passwords whenever possible. Generate a key pair with
ssh-keygenand copy the public key to the server. - Keep your private key secure and set strong permissions (e.g.,
chmod 600). - Disable password authentication on the server if you rely on keys.
- Use a non-standard port or a VPN to reduce automated attacks, but do not rely on obscurity alone.
- Verify the remote host’s fingerprint on first connection to avoid man-in-the-middle attacks.
- Do not use SCP over untrusted networks without additional encryption (though SSH already encrypts).
Alternatives to SCP
If SCP does not fit your needs, consider these alternatives:
- SFTP – Interactive, supports resuming, and is more flexible. Use
sftp user@host. - rsync – Best for syncing and backups; uses SSH for transport. Example:
rsync -avz /local/ user@host:/remote/. - HTTP/HTTPS – For one-way downloads, you can serve files with a web server or use tools like
curl. - Cloud storage – Services like Dropbox or Google Drive offer GUI-based sharing, but they involve third-party servers.
Each has trade-offs in speed, security, and convenience.
Frequently Asked Questions
Does SCP work on Windows?
Yes. Windows 10 and 11 include OpenSSH client, so you can use SCP from PowerShell or Command Prompt. You may need to enable the feature in Settings or install it via optional features.
How do I copy a file from one remote server to another?
You can specify both as remote paths, but SCP will route the transfer through your local machine unless you use a trick. For a direct server-to-server copy, you would need to SSH into one server and run SCP from there, or use a tool like rsync with a proxy.
Is SCP faster than SFTP?
Generally, SCP is slightly faster because it has less overhead, but the difference is often negligible. For large transfers, the network speed dominates.
Can I resume an interrupted SCP transfer?
No, SCP does not support resuming. If interrupted, you must restart the transfer. SFTP and rsync can resume.
How do I use a different SSH port with SCP?
Use the -P option (capital P). For example: scp -P 2222 file.txt user@host:
Why does SCP say “Permission denied� even though I can SSH?
This often happens when the remote directory is not writable by your user, or when the SSH server restricts SCP via a restricted shell. Check the directory permissions and the SSH configuration.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.