Anyone who administers Linux machines is conscious of protected shell. With out this instrument, administering these servers remotely may be pretty troublesome. It should moreover develop to be extra sturdy to maneuver recordsdata forwards and backwards, a minimal of with a modicum of security. That’s the place protected copy comes into play. With the SCP command, you probably can copy recordsdata to and from a distant Linux server via an encrypted SSH tunnel.

SEE: Simple strategies to View Your SSH Keys in Linux, macOS, and Dwelling home windows

Nonetheless, with the help of SSH key authentication, you too can make that rather more protected. I must current you the way in which that you must use protected key authentication and SCP so that you probably can leisure assured your recordsdata are being moved forwards and backwards securely. I will show on an Elementary OS shopper and Ubuntu 16.04.1 server and assume you may need a protected shell put in and dealing.

SSH keys

The very very first thing that need to be achieved is to create an SSH key pair. To try this, open up a terminal window and topic the command:

ssh-keygen -t rsa

You may be requested to name the file (use the default) and offers the keypair a passphrase.

As quickly because the necessary factor’s randomart prints, your key is ready to go.

The next step is to repeat the necessary factor to the distant server. That’s achieved with the command:

ssh-copy-id USER@SERVER

The place USER is the username of the distant server, and SERVER is the cope with of the distant server.

You may be prompted for the distant shopper password. While you effectively authenticate, most people key will possible be copied to the server. You’re in a position to go.

SEE: Securing Linux protection (Tech Skilled Evaluation)

Using SCP alongside along with your key

Now that our keys are in all the suitable places, let’s see how we’ll use them via SCP. Assuming you accepted the default title to your SSH key upon creation, the command to ship a file to your distant server using your SSH secret is:

scp -i ~/.ssh/id_rsa.pub FILENAME USER@SERVER:/dwelling/USER/FILENAME

The place FILENAME is the title of the file, USER is the username on the distant machine, and SERVER is the cope with of the distant server.

You must be prompted for the SSH key password (not the buyer password). As quickly as authenticated, the file will possible be transferred.

The similar holds true whether it is advisable pull a file from the distant server. The development of that command may be:

scp -i ~/.ssh/id_rsa.pub USER@SERVER:/dwelling/USER/FILENAME /dwelling/USER/FILENAME

As soon as extra, you may be requested to your SSH key password, and the file will possible be pulled from the server and copied to the native machine.

SEE: Simple strategies to Add an SSH Fingerprint to Your known_hosts File in Linux

Neglect that password

Let’s say you are about to bear a protracted session of copying recordsdata to your server. Constructive, you might probably tar all of them up into one larger file. Nevertheless say they need to all be positioned in quite a few directories. That’s various typing. Chances are you’ll make this barely further atmosphere pleasant by using the ssh-agent and ssh-add directions.

That’s correct, using the combination of SCP, SSH key authentication, and ssh-agent works successfully. This will preserve you from having to type that SSH key password every time you topic the SCP command. The one caveat is that you simply want to keep in mind the PID of the agent session and kill it when you’re achieved.

Proper right here’s what it is necessary to do.

1. Sooner than issuing the SCP command topic eval ssh-agent to start the session.
2. Make a remark of the Course of ID you are given when the session begins.
3. Add your SSH key to the session with the command ssh-add.
4. Start using SCP to repeat your recordsdata.

That’s all there could also be to it. If you happen to’re achieved with the session, assure to topic the command kill PID (the place PID is the exact amount given to you when you started the ssh-agent session with eval).

SEE: 20 quick tips to make Linux networking easier (free PDF) (roosho)

Is SCP nonetheless protected?

Any individual asking if SCP is protected has probably be taught the 2019 launch announcement for OpenSSH 8.0, which mentioned that the SCP protocol is “outdated, inflexible and by no means readily fixed” and advisable SFTP and Rsync as alternate choices for file change.

Sooner than OpenSSH 8.0, SCP could not verify file integrity all through transfers, leaving prospects uncovered to unauthorized overwrites and injection assaults if their server was compromised (CVE-2019-611). Nonetheless, the substitute launched stricter filename checking as a result of the default for the SCP command, making it safer, and moved its earlier non-checking habits to the command scp -T.

Then, in OpenSSH 9.0, launched in 2022, SFTP was adopted as a result of the default backend for SCP as a substitute of the legacy SCP/RCP protocol, that implies that transfers in the mean time are encrypted and authenticated with the SSH protocol. Whereas broadly regarded as protected, prospects must nonetheless be cautious of various risks like misconfigured servers or outdated software program program variations.

What can I exploit as a substitute of SCP?

• SFTP: Whereas SCP defaults to using the SFTP protocol, you probably can consider using native SFTP purchasers for superior file administration as a result of it permits for further operations, akin to viewing directories and file deletion.
• Rsync: Supreme for synchronizing recordsdata and directories, significantly for incremental backups and large datasets. See roosho’s info on how one can once more up a neighborhood using Rsync.
• FTPS: A protected chance for standard FTP transfers with SSL/TLS encryption, nevertheless it might be superior to configure.
• HTTPS-based devices: Corresponding to curl or wget, for protected downloads over HTTPS. That’s good for automation, nevertheless they don’t current full itemizing administration like SFTP.

Fiona Jackson updated this textual content in January 2025.