How to Securely Transfer Files in Linux Using SCP

Scp Transfer Linux 00 Featured Image

When transferring files to a remote Linux server, you have a few options. One of the best way is to use a program called Secure Copy, or SCP, that runs over the SSH protocol to quickly transfer files over your network to a remote system. This tutorial shows you how to transfer files securely using SCP in Linux.

Configuring SSH

On your remote server, you’ll need to install an SSH server. The most common on Linux is the OpenSSH server. To install it, run one of the following commands:

# Debian/Ubuntu-based server
sudo apt install ssh
# Fedora
sudo dnf install openssh
Scp Transfer Linux 01 Installing Ssh

Depending on your distro, you may need to allow SSH through some software firewalls. On Ubuntu, this problem is nonexistent, but on Fedora, you’ll also have to run the following commands:

sudo firewall-cmd --add-service=ssh --permanent
sudo firewall-cmd --reload
Scp Transfer Linux 02 Fedora Enable Firewall

Connecting to Your System via SSH

Before you can connect via SSH, you need to find out the IP address of the remote server. On graphical servers, the IP address is shown in the Network applet in System Settings. On most servers, you should use the ip command in the terminal.

ip addr
Scp Transfer Linux 04 Check Ip Address

In the output, look for the line starting with inet under ethX or enpXsy, depending on the way your network interface is connected to the system. In my case, it’s

To test the SSH connection, move to a different Linux machine and type:

ssh user@remote.machine.ip.address

Change the “user” to the actual username in the server.

Scp Transfer Linux 05 Connecting To Remote Server

Enter that account’s password, and you’re in business. If you get a question about the “authenticity of host can’t be established,” just answer “yes.” It is a security check designed to make sure that you are connecting to your actual server and not an impostor. You should see the same prompt come up on your client system that you see when logging directly into the server, which means your connection was successful. You should also configure your SSH connections for maximum security, or even set up two-factor authentication, before proceeding to the next step.

Using SCP to Transfer Files

Now that you have tested the SSH connection, start copying files between the two machines. Secure copying is achieved using the scp command. The basic format of the scp command is:


For example, to copy the file “backup.tar.gz” from the local machine to the “backups” folder in the home directory of user “ramces” on the remote server with the IP address of, use:

scp backup.tar.gz ramces@
Scp Transfer Linux 06 Basic Copying

Similar to when you connect using ssh, you will be prompted for the password. You won’t be prompted for the username, as that was specified in the command.

You can also use wild cards like the following:

scp *.tar.gz ramces@
Scp Transfer Linux 07 Glob Matching Copy

To copy a file from the remote server to the local machine, just reverse the parameters:

scp ramces@ ./
Scp Transfer Linux 08 Inverse Copying

Notice the dot at the end of the command? It means “the current directory,” as it does with the standard cp or mv commands. You could just as easily specify some other directory if you wanted to.

scp -r ramces@ backups-from-server/

And the same with wild cards:

scp ramces@*.txz ./

To recursively copy a directory to a remote server, use the -r option:

scp -r backups/ ramces@
Scp Transfer Linux 09 Recursive Copying

To copy a recursive copy of a directory from the remote server to the local machine, use:

scp -r ramces@ ./
Scp Transfer Linux 10 Reverse Recursive Copying

Compressing the File Transfer in SCP

Aside from basic copying, it is also possible to modify how SCP behaves during these file transfers. For example, you can use the -C flag to compress the data that SCP sends to remote clients:

scp -C backup.tar.gz ramces@

This option works by compressing each data packet as it is being sent through the SCP program. As such, this can be incredibly useful if you are in a bandwidth-limited connection and want to reliably send a file to a remote server.

Scp Transfer Linux 11 Data Compression Copy

Similar to the options above, you can also use -C alongside the -r flag to recursively compress and transfer files to a remote machine. For example, the following command compresses and retrieves the “backup.tar.gz” file from my remote server:

scp -Cr ramces@ /home/ramces/
Scp Transfer Linux 12 Reverse Data Compression Copy

Optimizing a Data Transfer with SCP

For the most part, SCP attempts to use the AES-128 encryption algorithm for all of its file transfers. However, there are instances where this particular algorithm will not be suitable for the files that you want to transfer.

Knowing that, it is possible to further optimize and secure SCP by directly changing the cipher algorithm for a specific transfer. To do this, you need to use the -c flag followed by the cipher that you want to use.

For example, the following command transfers the “backup.tar.gz” file to my remote server using AES-256:

scp -c aes256-ctr ./backup.tar.gz ramces@
Scp Transfer Linux 13 Change Default Cipher

Further, the -c option also allows you to provide a list of ciphers that you want to use for a particular file transfer. For example, the following command uses both AES-192 and AES-256 while transferring the “backup.tar.gz” file to my remote server:

scp -c aes192-ctr,aes256-ctr ./backup.tar.gz ramces@
Scp Transfer Linux 14 Create Cipher Preference List

Limiting Bandwidth Usage in SCP

While compressing file packets can help you use SCP in poor network conditions, it is also possible to limit the bandwidth that the program uses during a transfer. This is helpful in cases where you are using a metered connection and do not want SCP to dominate your network bandwidth.

To limit the program’s effective bandwidth, you need to use the -l flag followed by the upper limit that you want in kilobit per second (Kb/s). For example, running the following command will transfer the “backup.tar.gz” file to my remote server at an effective bandwidth of 1,600 Kb/s:

scp -l 1600 ./backup.tar.gz ramces@
Scp Transfer Linux 15 Limit Bandwidth During Copy

Remote to Remote Transfer with SCP

Aside from copying local files to your remote server and vice versa, you can also use SCP to manage multiple remote servers from your local machine, as SCP only deals with file transfer and does not discriminate between a local and remote machine.

To transfer between two remote servers, you need to explicitly state the username and the address of each of those machines. For example, running the following command will transfer my “remote-backup.tar.gz” file between my two remote servers:

scp ramces@ ramces@
Scp Transfer Linux 16 Remote To Remote Copy

Using a Proxy with SCP

By default, SCP uses your local machine’s IP address whenever it transfers files between different hosts. While this is perfectly fine in normal situations, it can be a problem if your local network restricts any SCP activity. One quick way to deal with this issue is by passing your local connection through an SSH proxy.

To do this, you need to use the -o flag followed by the ProxyCommand option. This allows you to create a basic SSH connection to a new machine which will, in turn, execute your SCP command. For example, running the following will create a new SSH proxy with a remote machine and transfer the “backup.tar.gz” file using it:

scp -o "ProxyCommand ssh ramces@ nc %h %p" ./backup.tar.gz ramces@
Scp Transfer Linux 17 Ssh Proxy Bypass

Changing the Default Port in SCP

Aside from creating a basic SSH proxy, you can also change the default port for SCP. This is especially helpful if you are securing your Linux server and do not want to expose any default ports.

To use SCP with a different port, you need to use the -P flag followed by the port number that you want to use. For example, the following command will recursively copy my “backup” directory and connect to my remote server using port 2222:

scp -r -P 2222 ./backup ramces@
Scp Transfer Linux 18 Using Custom Port

Using the SCP Quiet Mode

Lastly, it is also possible to completely remove any terminal output from an SCP command. This is especially useful if you want to create a non-interactive script that will run in your machine. Not only that, but you can also fully automate this process by creating a cronjob and transferring a private SSH key to your server.

To create a quiet SCP transfer, you need to use the -q flag. For example, the following command will transfer my “backup.tar.gz” file silently to my remote server:

scp -q ./backup.tar.gz ramces@
Scp Transfer Linux 19 Quiet Mode

Frequently Asked Questions

My remote to remote transfer in SCP does not work. How can I fix this?

This issue is most likely due to a blocked port in one of your remote machine’s configuration files. To fix this issue, make sure the default port for SSH is open in both of your machines.

This issue can also be due to one of your remote machines being behind a CG-NAT connection, so any outside connection to your remote machine will not resolve properly. To fix this, you need to use a Virtual LAN program, such as Yggdrasil, that will allow you to punch through CG-NAT.

I ran an SCP proxy and the remote host closed the connection. What can I do?

This problem is most likely due to an issue with your proxy machine. To properly start an SSH proxy, make sure that the machine you want to use has the OpenSSH server and netcat. To install these programs in Ubuntu, run the following command: sudo apt install ssh netcat.

Is it possible to know all of the available ciphers for SCP?

By default, the SCP program heavily relies on the SSH protocol for its cryptographic functions. Because of that, you can use the SSH program to print a list of the ciphers that you can use alongside SCP. For example, you can run ssh -Q ciphers to print a brief list of all the available ciphers in your machine.

Image credit: Unsplash. All alterations and screenshots by Ramces Red.

Ramces Red
Ramces Red

Ramces is a technology writer that lived with computers all his life. A prolific reader and a student of Anthropology, he is an eccentric character that writes articles about Linux and anything *nix.

Subscribe to our newsletter!

Our latest tutorials delivered straight to your inbox