Malwarebytes - Cybersecurity for Everyone

Linux scp Command Cheat Sheet: Secure File Transfer Made Easy

byShubham Chaudhary •November 12, 2026

0

Linux terminal showing scp command copying a file securely over SSH between two servers in a SOC workflow

Linux scp Command Cheat Sheet: Secure File Transfer for SOC and Sysadmin Workflows

Last verified: November 12, 2026. scp behavior varies by OpenSSH version, so check yours with ssh -V.

It is 2 a.m. and an alert fires on a production web server: unusual outbound SSH traffic. You need the authentication logs on your workstation before anyone touches the box. You also need proof the copy is clean. This is exactly where secure file transfer with scp earns its place. It is one command and it is available on almost every Linux system. It is also a tool attackers use to move data out, so defenders should understand both sides of it.

scp Basics: Upload and Download

The pattern is always scp source destination. A remote path takes the form user@host:/path.

scp file.txt user@host:/path/
scp user@host:/path/file.txt .
scp user@host:/var/log/auth.log /tmp/

The first command uploads a local file. The second downloads a remote file into the current directory. The third downloads an authentication log into /tmp. Expect a progress meter showing file name, percentage, size and speed. Use -q to suppress it in scripts.

Remember that user@host: with nothing after the colon, or user@host:~, targets the remote user's home directory. IPv6 addresses need brackets: user@[2001:db8::10]:/backup/. Force the address family with -4 or -6 when dual-stack DNS misbehaves.

Multiple Files and Directories

scp file1.txt file2.txt user@host:/path/
scp *.log user@host:/backup/logs/
scp -r folder user@host:/path/
scp -r user@host:/var/log/ /tmp/remote-logs/

Use -r for directories. Local wildcards are expanded by your own shell. Remote wildcards such as user@host:/var/log/*.log depend on how the server handles expansion, and that can differ between SFTP mode and legacy SCP mode. Quote paths with spaces: scp user@host:"/path/my file.txt" .. For a local file whose name starts with a hyphen, use ./-file.txt.

Ports, Keys and SSH Options

This is where most typos happen. -P (uppercase) sets the port, and -p (lowercase) preserves timestamps and file modes. Mixing them up is a classic mistake.

scp -P 2222 file.txt user@host:/path/
scp -p file.txt user@host:/path/
scp -i ~/.ssh/id_ed25519 file.txt user@host:/path/
scp -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 file.txt user@host:/path/

The IdentitiesOnly=yes option stops SSH from offering every key in your agent. That avoids lockouts on servers with low authentication-attempt limits. Protect private keys with chmod 600 ~/.ssh/id_ed25519. Note that -p does not guarantee ownership or full metadata preservation. Use rsync when that matters.

Useful -o options include:

ConnectTimeout=10 fails fast on dead hosts.
StrictHostKeyChecking=yes refuses unknown or changed host keys.
BatchMode=yes disables password and passphrase prompts for automation.
ServerAliveInterval=30 and ServerAliveCountMax=3 keep long transfers alive through flaky firewalls.
PreferredAuthentications=publickey forces key-based login.

For repeat targets, put the settings in ~/.ssh/config and use the alias:

Host myserver
    HostName 192.168.1.10
    User analyst
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

scp report.pdf myserver:~/reports/

This is cleaner and less error-prone than long command lines. Use -F to point to an alternate config file.

SFTP Mode vs Legacy SCP Protocol

According to the OpenSSH release notes, version 9.0 switched scp to use the SFTP protocol by default instead of the old SCP/RCP protocol. That change matters for security. The legacy protocol relied on the remote shell to interpret file names. Researchers documented command-injection concerns, such as CVE-2020-15778, where crafted remote paths could trigger shell execution on the server. The OpenSSH project has treated this as an inherent weakness of the legacy design.

scp -s file.txt user@host:/path/
scp -O file.txt user@host:/path/

-s forces SFTP where your version supports it. -O forces the legacy protocol. Reserve -O for old appliances and embedded devices that lack an SFTP subsystem. If you see "Subsystem request failed," the server's SFTP subsystem is not configured, and -O may be your temporary workaround.

Remote-to-Remote and Jump Host Transfers

scp user1@host1:/path/file.txt user2@host2:/path/
scp -3 user1@host1:/path/file.txt user2@host2:/path/
scp -R user1@host1:/path/file.txt user2@host2:/path/
scp -J user@bastion.example.com file.txt user@internal-host:/path/

With -3, data flows through your local machine. Credentials for each host stay local. Recent OpenSSH releases route remote-to-remote copies this way by default, while -R requests a direct host-to-host copy. The direct mode requires the source host to authenticate to the destination, and that has different security implications. Avoid it unless you understand the trust relationship. A single -P applies to both connections.

For segmented networks, -J (or -o ProxyJump=) sends the transfer through a bastion host. That fits zero-trust remote access designs better than opening direct paths to internal servers.

SOC and DFIR Evidence Collection Workflow

Back to the 2 a.m. alert. A disciplined collection looks like this:

mkdir -p ./evidence/server-logs
scp -P 2222 analyst@server:/var/log/auth.log ./evidence/
scp -r analyst@server:/var/log/ ./evidence/server-logs/
sha256sum ./evidence/auth.log
ssh analyst@server 'sha256sum /var/log/auth.log'

If the two hashes match, the copy is intact. Be aware that actively written logs such as auth.log may change between the copy and the remote hash, so a mismatch on a live file can be innocent. Hash both sides as close together as possible. For formal evidence, record the source host, timestamps and who performed the acquisition.

A practical checklist:

Confirm authorization and the target hostname.
Verify the SSH host key through a trusted channel.
Use an approved, dedicated key (for example -i ~/.ssh/ir_key).
Transfer into a controlled evidence directory.
Calculate and record SHA-256 hashes.
Log source, destination and acquisition times.
Restrict access to the collected data.
Avoid modifying source evidence during collection.

Use -p to keep timestamps and modes on files like an evidence archive, and use ssh user@host 'stat /path/file' to document remote metadata. For full forensic imaging, dedicated DFIR tooling is more appropriate than scp.

Automation, Bandwidth and Scripting

scp -o BatchMode=yes -q report.pdf analyst@server:/backup/ && echo "Transfer completed"
scp -l 800 largefile.zip user@host:/backup/
scp -C -l 1000 file.txt user@host:/backup/

-l is measured in Kbit/s, not KB/s. So -l 800 is roughly 100 KB/s. Compression with -C helps text and logs but does little for ZIP files or other compressed data. Always check the exit code in scripts, because && and || make failures visible. Set up key-based authentication and verified host keys before automating anything.

Troubleshooting Common scp Errors

Start with scp -v (or -vvv) and test SSH separately with ssh -v user@host.

Error	Likely Cause
Permission denied	Authentication failure or filesystem permissions
No such file or directory	Source or destination path does not exist
Connection refused	SSH service down, wrong port, or rejected
Connection timed out	Network or firewall issue
Host key verification failed	Host identity mismatch; investigate before bypassing
No space left on device / Disk quota exceeded	Full filesystem or user quota (check with `df -h`)
Subsystem request failed	SFTP subsystem not configured on the server

Treat "Host key verification failed" as a security signal, not an annoyance. It can mean a rebuilt server, but it can also indicate interception. Verify the fingerprint through a trusted channel before using ssh-keyscan output or removing old entries.

scp vs rsync vs sftp

Tool	Best For
scp	Straightforward one-time copies
rsync	Repeated sync, resuming, efficient updates, ownership preservation
sftp	Interactive file management

Warning: rsync -av --delete removes destination files that are absent from the source. Review the paths carefully, or test with --dry-run first.

Detecting scp Misuse and Hardening SSH

From the defender's side, scp is a legitimate tool that adversaries also use. MITRE ATT&CK catalogs SSH-based lateral movement (T1021.004), tool transfer into a compromised network (T1105) and exfiltration over alternative protocols (T1048). Because scp traffic is encrypted, you detect it through context rather than content.

Authentication logs: review /var/log/auth.log or /var/log/secure for unexpected "Accepted publickey" or "Accepted password" events, new source IPs and odd hours.
Process and audit telemetry: look for scp or sshd child processes launched by service accounts that never transfer files. EDR and auditd rules can capture them.
Network volume: alert on large outbound transfers over port 22 or non-standard SSH ports from servers that rarely send data out.
Key hygiene: audit authorized_keys files for keys you cannot attribute to an owner.

Expert Tips

Always test a new destination path with a small file first.
Use SSH config aliases so the port and key are never typed by hand.
Check ssh -V so you know whether your client defaults to SFTP.
Never disable host key checking just to get a transfer to work.
Hash before and after for anything that will be used as evidence.
Use man scp as the final authority on your installed version.

To install the client: sudo apt install openssh-client (Debian, Ubuntu, Kali), sudo dnf install openssh-clients (Fedora, RHEL-based), sudo pacman -S openssh (Arch) or sudo zypper install openssh (openSUSE).

Linux curl Command Cheat Sheet for SOC Analysts (2026)
Linux wget Command Cheat Sheet (2026): Download Like a Pro
Linux ss Command Cheat Sheet: Find Suspicious Connections Fast
Linux netstat Command Cheat Sheet: Spot Suspicious Connections Fast
Linux traceroute Command Cheat Sheet: Find Network Hops Fast (2026)
Linux Ping Command Cheat Sheet (2026): Complete Guide
Linux ifconfig Cheat Sheet: Commands, MTU, MAC & PROMISC
Linux ip Command Cheat Sheet: Spot Rogue Routes & ARP Spoofing

FAQ

Is scp secure?

scp encrypts data in transit using SSH. Its security depends on strong authentication, verified host keys and a patched OpenSSH version.

Is scp deprecated?

The OpenSSH project has described the legacy SCP protocol as outdated. The scp command itself still works and now uses SFTP by default in modern releases.

What is the difference between -P and -p?

Uppercase -P sets the SSH port. Lowercase -p preserves modification times, access times and file modes.

How do I resume an interrupted scp transfer?

scp cannot resume. Use rsync -av --partial --progress over SSH for large or unreliable transfers.

How do I copy through a bastion host?

Use scp -J user@bastion.example.com file.txt user@internal-host:/path/, or configure ProxyJump in your SSH config.

How do I verify a file copied correctly?

Run sha256sum on both the local and remote file and compare the output. Do this close together in time for files that are still being written.

Conclusion

scp is simple, but the details decide whether a transfer is reliable, auditable and safe. Know the -P versus -p trap, prefer SFTP mode, verify host keys and hash everything you collect. Pair that with good SSH logging and key hygiene, and you can use scp confidently for both administration and incident response, while noticing when someone else is using it against you.

Analysis based on SOC monitoring experience and review of public OpenSSH documentation.