scp

scp SOURCE TARGET, where a remote side is USER@HOST:PATH (a path without / is in that user's home). It logs in as ssh does, with a password or a key, and everything travels encrypted. Routers back up and restore configurations with it (copy running-config scp:).

scp command usage

scp [-P PORT] [-o OPTION] SOURCE USER@HOST:PATH
scp USER@HOST:PATH TARGET

Options

-P 2222

the server's port (capital P, unlike ssh)

-o StrictHostKeyChecking=no

accept an unknown host key (labs only)

-r

copy a directory

scp examples

scp /etc/frr/frr.conf backup@10.0.9.10:officeRouter.conf

Copies the saved config into the backup account's home.

scp backup@10.0.9.10:officeRouter.conf /tmp/restore.conf

Fetches it back.

scp report.txt ana@10.0.1.10:/tmp/

Copies a local file into /tmp on 10.0.1.10.

scp -r configs/ backup@10.0.9.10:

Copies a whole directory into the backup account's home.

scp -P 2222 report.txt admin@10.0.2.2:

Uses the server's port 2222: capital -P, where ssh takes -p.

scp -i ~/.ssh/backup_ed25519 frr.conf backup@10.0.9.10:

Logs in with that private key instead of the default ones.

scp -p frr.conf backup@10.0.9.10:

Keeps the file's modification time and mode on the copy.

scp 'admin@10.0.1.10:/var/log/*.log' logs/

Copies every .log file; the quotes keep your own shell from expanding the *.

scp admin@10.0.1.10:/etc/hosts admin@10.0.2.10:/tmp/

Copies between two remote machines, through yours (the default since OpenSSH 8.7).

scp -J admin@bastion.lab report.txt admin@10.0.3.10:

Reaches an inside server through the bastion host, as ssh -J does.

scp -l 8000 netlab.iso backup@10.0.9.10:

Caps the copy at 8000 Kbit/s (about 1 MB/s) so it leaves room on the link.

scp -C access.log backup@10.0.9.10:

Compresses on the way: faster for text over a slow link, slower on a fast one.

scp -O frr.conf admin@oldRouter.lab:

Uses the legacy SCP protocol for an old server without SFTP, since OpenSSH 9.0 runs scp over SFTP.

Pitfalls

• Accepting any host key (StrictHostKeyChecking=no) gives up the protection against a fake server; a real backup job pins the key.

Run it on real machines