7.5. Secure Copy with scpThe secure copy program, scp, obeys keywords in your client configuration file just as ssh does. In addition, scp provides other features and options that we'll cover in this section.
7.5.1. Full SyntaxSo far, we've described the syntax of scp only in general: [Section 2.2.1, "File Transfer with scp"]
Each of the two names, or path specifications, on the command line represents files or directories in the following manner (it is fairly consistent with the behavior of Unix cp or rcp):scp name-of-source name-of-destination
Table 7-3 summarizes the syntax of an scp path.$ scp myfile myfile2 A local copy just like cp $ scp myfile bob@host1: Copy . /myfile to ~bob on host1 $ scp bob@host1:myfile . Copy ~bob/myfile on host1 to ./myfile $ scp host1:file1 host2:file2 Copy file1 from host1 to file2 on host2 $ scp bob@host1:file1 jen@host2:file2 Same as above, but copying from bob's to jen's account
Table 7-3. scp Path Specifications
7.5.2. Handling of Wildcardsscp for SSH1 and OpenSSH has no special support for wildcards in filenames. It simply lets the shell expand them:
Watch out for wildcards in remote file specifications, as they are evaluated on the local machine, not the remote. For example, this attempt is likely to fail:$ scp *.txt server.example.com:
The Unix shell attempts to expand the wildcard before scp1 is invoked, but the current directory contains no filename matching "server.example.com:*.txt". C shell and its derivatives will report "no match" and not execute scp1. Bourne-style shells, noticing no match in the current directory, will pass the unexpanded wildcard to scp1, and the copy may succeed as planned, but this coincidental behavior shouldn't be relied on. Always escape your wildcards so they are explicitly ignored by the shell and passed to scp1:$ scp1 server.example.com:*.txt . Bad idea!
scp2 does its own regular expression matching after shell-wildcard expansion is complete. The sshregex manpage for SSH2 (see Appendix A, "SSH2 Manpage for sshregex") describes the supported operators. Even so, escape your wildcard characters if you want your local shell to leave them alone.$ scp1 server.example.com:\*.txt .
7.5.3. Recursive Copy of DirectoriesSometimes you want to copy not just a single file but a directory hierarchy. In this case, use the -r option, which stands for recursive. If you are familiar with rcp, its -r option has the same effect. For example, to securely copy the directory /usr/local/bin and all its files and subdirectories to another machine:
If you forget the -r option when copying directories, scp complains:# SSH1, SSH2, OpenSSH $ scp -r /usr/local/bin server.example.com:
Although scp can copy directories, it isn't necessarily the best method. If your directory contains hard links or soft links, they won't be duplicated. Links are copied as plain files (the link targets), and worse, circular directory links cause scp1 to loop indefinitely. (scp2 detects symbolic links and copies their targets instead.) Other types of special files, such as named pipes, also aren't copied correctly. A better solution is to use tar, which handles special files correctly, and send it to the remote machine to be untarred, via SSH:$ scp /usr/local/bin server.example.com: /usr/local/bin: not a regular file
These limitations also are true when copying single files, but at least you see the erroneous result quickly. With directories, you can copy a hierarchy incorrectly and not notice.
$ tar cf - /usr/local/bin | ssh server.example.com tar xf -
7.5.4. Preserving PermissionsWhen scp copies files, the destination files are created with certain file attributes. By default, the file permissions adhere to a umask on the destination host, and the modification and last access times will be the time of the copy. Alternatively, you can tell scp to duplicate the permissions and timestamps of the original files. The -p option accomplishes this:
For example, if you transfer your entire home directory to a remote machine, you probably want to keep the file attributes the same as the original:# SSH1, SSH2, OpenSSH $ scp -p myfile server.example.com:
$ scp -rp $HOME server.example.com:myhome/
7.5.5. Automatic Removal of Original FileAfter copying a file, scp2 can optionally remove the original if desired. The -u command-line option specifies this:
If you've ever wanted a "secure move" command in addition to secure copy, you can define one in terms of scp2 -u:# SSH2 only $ scp2 myfile server.example.com: $ ls myfile myfile $ scp2 -u myfile server.example.com: $ ls myfile myfile: No such file or directory
$ alias smv='scp2 -u'
7.5.6. Safety Featuresscp has two features to protect you from running dangerous commands. Suppose you want to copy a local file myfile to a remote directory. You type:
Then you connect to server.example.com and find, to your horror, that mydir was a file, not a directory, and you just overwrote it! The -d option prevents this tragedy. If the destination isn't a directory, scp complains and exits without copying the file.# SSH1, SSH2, OpenSSH $ scp2 myfile server.example.com:mydir $ rm myfile
This option is necessary only if you are copying a single file. If you are copying multiple files or a directory, all the scp implementations check by default that the remote destination is a directory.# SSH1, SSH2, OpenSSH $ scp2 -d myfile server.example.com:mydir warning: Destination file is not a directory. warning: Exiting.
There's one degenerate case. If your copy occurs on a single machine, e.g., scp *.c mydir, the scp client doesn't necessarily check that mydir is a directory.Another safety feature of scp2 is the -n option, which instructs the program to describe its actions but not perform any copying. This is useful for verifying the behavior of scp2 before executing a potentially risky command.
# SSH2 only $ scp2 -n myfile server.example.com: Not transferring myfile -> server.example.com:./myfile (1k)
7.5.7. Statistics DisplayAs scp copies files, it may print statistics about its progress.
188.8.131.52. scp1 statisticsFor scp1, the statistics display is configurable by command-line options and environment variables:
For starters, scp1 must be compiled with the configuration flag -- with-scp-stats, or else statistics will be unavailable. [Section 184.108.40.206, "scp behavior"]
For each file, scp1 displays the name, the size, the transfer rate, and a two-part progress meter about the transmission. "ETA" (Estimated Time of Arrival) is the estimated transfer time, and the final number is the percentage of the file transmitted so far. While the file is transferring, the ETA value counts down to zero and the percentage increases to 100, though you can't see this on the printed page. Although the statistics are informative, you might want to change or disable them. For example, you might prefer to turn them off when scp1 is part of a batch job that shouldn't produce screen output. This statistics display can be configured in several ways, using command-line options and environment variables (see Table 7-4: note that command-line options take precedence over environment variables).$ scp1 myfile* server.example.com: myfile1 | 50 KB | 50.0 kB/s | ETA: 00:00:00 | 100% myfile2 | 31 KB | 31.3 kB/s | ETA: 00:00:00 | 100% myfile3 | 3 KB | 3.8 kB/s | ETA: 00:00:00 | 100%
Table 7-4. Controlling Statistics in scp1
To enable statistics, use either of these:# SSH1, OpenSSH $ scp -q myfile server.example.com: # SSH1 only $ setenv SSH_NO_SCP_STATS 1 $ scp1 myfile server.example.com:
If statistics are enabled, you may also choose to print file-by-file statistics. This is done with the options -a and -A, or the environment variables SSH_ALL_SCP_STATS and SSH_NO_ALL_SCP_STATS. To print file-by-file statistics, use either of these:# SSH1 only $ scp1 -Q myfile server.example.com: # SSH1 only $ setenv SSH_SCP_STATS 1 $ scp1 myfile server.example.com:
or to print a single, cumulative statistic:# SSH1 only $ scp1 -Q -a myfile server.example.com: # SSH1 only $ setenv SSH_ALL_SCP_STATS 1 $ scp1 myfile server.example.com:
# SSH1 only $ scp1 -Q -A myfile server.example.com: # SSH1 only $ setenv SSH_NO_ALL_SCP_STATS 1 $ scp1 myfile server.example.com:
220.127.116.11. scp2 statisticsThe statistics display for scp2 is configurable as well, but as of SSH2 2.1.0, this information is missing from the manpage. By default, the statistics display is enabled, and there's no compile-time option like SSH1's -- with-scp-stats to disable it. The display looks different from that of scp1:
The progress indicators (dotted lines) change as the files are transferred, but frankly we find them unintuitive. To suppress the statistics display, use the -Q command-line option (yes, it has the opposite meaning of SSH1's -Q option):$ scp2 myfile* server.example.com: Transfering myfile1 -> server.example.com:./myfile1 (50k) |................................................................| 51200 bytes transferred in 1.00 seconds [50.0 kB/sec]. Transfering myfile2 -> server.example.com:./myfile2 (30k) |................................................................| 31744 bytes transferred in 1.03 seconds [31.3 kB/sec]. Transfering myfile3 -> server.example.com:./myfile3 (3k) |................................................................| 3068 bytes transferred in 0.79 seconds [3.8 kB/sec].
$ scp2 -Q myfile server.example.com:
7.5.8. Locating the ssh ExecutableTo copy files securely, scp invokes ssh internally. Therefore, scp needs to know where the ssh executable resides on disk. Normally, the path to ssh is made known to scp at compile time (by the compile-time flag -- prefix), but you can specify the path manually if you like. [Section 18.104.22.168, "Installation, files, and directories"] For instance, you can test a new version of ssh with an old version of scp. The command-line option -S specifies the path:
# SSH1, SSH2 $ scp -S /usr/alternative/bin/ssh myfile server.example.com:
7.5.9. For Internal Use Onlyscp for SSH1 and OpenSSH has two undocumented options, -t and -f, for internal use. Most likely you will never need to use them explicitly. They inform scp of the direction of the copy: from the local to the remote machine, or from remote to local. The -t option means copying to a remote machine and -f means copying from a remote machine. Whenever you invoke scp, it invisibly runs a second scp process on the remote host that includes either -t or -f on its command line. You can see this if you run scp in verbose mode. If copying from the local to the remote machine, you see:
On the other hand, if you copy from the remote to the local machine, you see:$ scp -v myfile server.example.com: Executing: host server.example.com, ..., command scp -v -t . ...
Again, it's likely you'll never use these options, but they're useful to know when reading scp's output in verbose mode. Also, the scp2 manpage mentions them, so it's good to understand what they are.$ scp -v server.example.com:myfile . Executing: host server.example.com, ..., command scp -v -f . ...
Copyright © 2002 O'Reilly & Associates. All rights reserved.