1.\" 2.\" scp.1 3.\" 4.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 5.\" 6.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 7.\" All rights reserved 8.\" 9.\" Created: Sun May 7 00:14:37 1995 ylo 10.\" 11.\" $OpenBSD: scp.1,v 1.108 2022/02/23 21:21:16 djm Exp $ 12.\" 13.Dd $Mdocdate: February 23 2022 $ 14.Dt SCP 1 15.Os 16.Sh NAME 17.Nm scp 18.Nd OpenSSH secure file copy 19.Sh SYNOPSIS 20.Nm scp 21.Op Fl 346ABCOpqRrsTv 22.Op Fl c Ar cipher 23.Op Fl D Ar sftp_server_path 24.Op Fl F Ar ssh_config 25.Op Fl i Ar identity_file 26.Op Fl J Ar destination 27.Op Fl l Ar limit 28.Op Fl o Ar ssh_option 29.Op Fl P Ar port 30.Op Fl S Ar program 31.Ar source ... target 32.Sh DESCRIPTION 33.Nm 34copies files between hosts on a network. 35.Pp 36It uses 37.Xr ssh 1 38for data transfer, and uses the same authentication and provides the 39same security as a login session. 40.Pp 41.Nm 42will ask for passwords or passphrases if they are needed for 43authentication. 44.Pp 45The 46.Ar source 47and 48.Ar target 49may be specified as a local pathname, a remote host with optional path 50in the form 51.Sm off 52.Oo user @ Oc host : Op path , 53.Sm on 54or a URI in the form 55.Sm off 56.No scp:// Oo user @ Oc host Oo : port Oc Op / path . 57.Sm on 58Local file names can be made explicit using absolute or relative pathnames 59to avoid 60.Nm 61treating file names containing 62.Sq :\& 63as host specifiers. 64.Pp 65When copying between two remote hosts, if the URI format is used, a 66.Ar port 67cannot be specified on the 68.Ar target 69if the 70.Fl R 71option is used. 72.Pp 73The options are as follows: 74.Bl -tag -width Ds 75.It Fl 3 76Copies between two remote hosts are transferred through the local host. 77Without this option the data is copied directly between the two remote 78hosts. 79Note that, when using the legacy SCP protocol (via the 80.Fl O 81flag), this option 82selects batch mode for the second host as 83.Nm 84cannot ask for passwords or passphrases for both hosts. 85This mode is the default. 86.It Fl 4 87Forces 88.Nm 89to use IPv4 addresses only. 90.It Fl 6 91Forces 92.Nm 93to use IPv6 addresses only. 94.It Fl A 95Allows forwarding of 96.Xr ssh-agent 1 97to the remote system. 98The default is not to forward an authentication agent. 99.It Fl B 100Selects batch mode (prevents asking for passwords or passphrases). 101.It Fl C 102Compression enable. 103Passes the 104.Fl C 105flag to 106.Xr ssh 1 107to enable compression. 108.It Fl c Ar cipher 109Selects the cipher to use for encrypting the data transfer. 110This option is directly passed to 111.Xr ssh 1 . 112.It Fl D Ar sftp_server_path 113When using the SFTP protocol support via 114.Fl M , 115connect directly to a local SFTP server program rather than a 116remote one via 117.Xr ssh 1 . 118This option may be useful in debugging the client and server. 119.It Fl F Ar ssh_config 120Specifies an alternative 121per-user configuration file for 122.Nm ssh . 123This option is directly passed to 124.Xr ssh 1 . 125.It Fl i Ar identity_file 126Selects the file from which the identity (private key) for public key 127authentication is read. 128This option is directly passed to 129.Xr ssh 1 . 130.It Fl J Ar destination 131Connect to the target host by first making an 132.Nm 133connection to the jump host described by 134.Ar destination 135and then establishing a TCP forwarding to the ultimate destination from 136there. 137Multiple jump hops may be specified separated by comma characters. 138This is a shortcut to specify a 139.Cm ProxyJump 140configuration directive. 141This option is directly passed to 142.Xr ssh 1 . 143.It Fl l Ar limit 144Limits the used bandwidth, specified in Kbit/s. 145.It Fl O 146Use the legacy SCP protocol for file transfers instead of the SFTP protocol. 147Forcing the use of the SCP protocol may be necessary for servers that do 148not implement SFTP, for backwards-compatibility for particular filename 149wildcard patterns and for expanding paths with a 150.Sq ~ 151prefix for older SFTP servers. 152.It Fl o Ar ssh_option 153Can be used to pass options to 154.Nm ssh 155in the format used in 156.Xr ssh_config 5 . 157This is useful for specifying options 158for which there is no separate 159.Nm scp 160command-line flag. 161For full details of the options listed below, and their possible values, see 162.Xr ssh_config 5 . 163.Pp 164.Bl -tag -width Ds -offset indent -compact 165.It AddressFamily 166.It BatchMode 167.It BindAddress 168.It BindInterface 169.It CanonicalDomains 170.It CanonicalizeFallbackLocal 171.It CanonicalizeHostname 172.It CanonicalizeMaxDots 173.It CanonicalizePermittedCNAMEs 174.It CASignatureAlgorithms 175.It CertificateFile 176.It CheckHostIP 177.It Ciphers 178.It Compression 179.It ConnectionAttempts 180.It ConnectTimeout 181.It ControlMaster 182.It ControlPath 183.It ControlPersist 184.It GlobalKnownHostsFile 185.It GSSAPIAuthentication 186.It GSSAPIDelegateCredentials 187.It HashKnownHosts 188.It Host 189.It HostbasedAcceptedAlgorithms 190.It HostbasedAuthentication 191.It HostKeyAlgorithms 192.It HostKeyAlias 193.It Hostname 194.It IdentitiesOnly 195.It IdentityAgent 196.It IdentityFile 197.It IPQoS 198.It KbdInteractiveAuthentication 199.It KbdInteractiveDevices 200.It KexAlgorithms 201.It KnownHostsCommand 202.It LogLevel 203.It MACs 204.It NoHostAuthenticationForLocalhost 205.It NumberOfPasswordPrompts 206.It PasswordAuthentication 207.It PKCS11Provider 208.It Port 209.It PreferredAuthentications 210.It ProxyCommand 211.It ProxyJump 212.It PubkeyAcceptedAlgorithms 213.It PubkeyAuthentication 214.It RekeyLimit 215.It SendEnv 216.It ServerAliveInterval 217.It ServerAliveCountMax 218.It SetEnv 219.It StrictHostKeyChecking 220.It TCPKeepAlive 221.It UpdateHostKeys 222.It User 223.It UserKnownHostsFile 224.It VerifyHostKeyDNS 225.El 226.It Fl P Ar port 227Specifies the port to connect to on the remote host. 228Note that this option is written with a capital 229.Sq P , 230because 231.Fl p 232is already reserved for preserving the times and mode bits of the file. 233.It Fl p 234Preserves modification times, access times, and file mode bits from the 235source file. 236.It Fl q 237Quiet mode: disables the progress meter as well as warning and diagnostic 238messages from 239.Xr ssh 1 . 240.It Fl R 241Copies between two remote hosts are performed by connecting to the origin 242host and executing 243.Nm 244there. 245This requires that 246.Nm 247running on the origin host can authenticate to the destination host without 248requiring a password. 249.It Fl r 250Recursively copy entire directories. 251Note that 252.Nm 253follows symbolic links encountered in the tree traversal. 254.It Fl S Ar program 255Name of 256.Ar program 257to use for the encrypted connection. 258The program must understand 259.Xr ssh 1 260options. 261.It Fl T 262Disable strict filename checking. 263By default when copying files from a remote host to a local directory 264.Nm 265checks that the received filenames match those requested on the command-line 266to prevent the remote end from sending unexpected or unwanted files. 267Because of differences in how various operating systems and shells interpret 268filename wildcards, these checks may cause wanted files to be rejected. 269This option disables these checks at the expense of fully trusting that 270the server will not send unexpected filenames. 271.It Fl v 272Verbose mode. 273Causes 274.Nm 275and 276.Xr ssh 1 277to print debugging messages about their progress. 278This is helpful in 279debugging connection, authentication, and configuration problems. 280.El 281.Sh EXIT STATUS 282.Ex -std scp 283.Sh SEE ALSO 284.Xr sftp 1 , 285.Xr ssh 1 , 286.Xr ssh-add 1 , 287.Xr ssh-agent 1 , 288.Xr ssh-keygen 1 , 289.Xr ssh_config 5 , 290.Xr sftp-server 8 , 291.Xr sshd 8 292.Sh HISTORY 293.Nm 294is based on the rcp program in 295.Bx 296source code from the Regents of the University of California. 297.Pp 298Since OpenSSH 9.0, 299.Nm 300has use the SFTP protocol for transfers by default. 301.Sh AUTHORS 302.An Timo Rinne Aq Mt tri@iki.fi 303.An Tatu Ylonen Aq Mt ylo@cs.hut.fi 304.Sh CAVEATS 305The legacy SCP protocol (selected by the 306.Fl O 307flag) requires execution of the remote user's shell to perform 308.Xr glob 3 309pattern matching. 310This requires careful quoting of any characters that have special meaning to 311the remote shell, such as quote characters. 312