Secure file transfer is essential for protecting sensitive data when copying files between systems. This guide covers the two primary secure file transfer protocols that leverage SSH for encryption and authentication: SCP (Secure Copy Protocol) and SFTP (SSH File Transfer Protocol).

Quick Start

Most users can start with these commands:

# Upload one file
scp file.txt user@host:/remote/path/

# Download one file
scp user@host:/remote/path/file.txt ./

# Interactive SFTP session
sftp user@host

For automation or reliability-sensitive jobs, prefer SFTP batch mode or rsync over SSH.

Secure Copy Protocol (SCP)

SCP is a network protocol that uses SSH for data transfer and provides the same authentication and security as SSH. It helps users securely transfer files between a local and remote host or between two remote hosts.

Note: For automation and reliability-sensitive workflows, prefer SFTP or rsync over SSH when possible. SCP behavior can vary across implementations and OpenSSH versions.

In practice, this matters because SCP has historically had differences in path handling, wildcard expansion, and quoting behavior depending on client/server implementation and version. These differences can cause scripts to behave differently across environments.

For unattended jobs, SFTP and rsync are generally safer choices:

SFTP: More predictable protocol semantics, better error handling, and batch mode support (sftp -b).
rsync over SSH: Better for large or interrupted transfers due to delta transfer, resume-friendly behavior, and strong verification options.

If transfer reliability is critical (backups, scheduled syncs, CI/CD artifacts), favor SFTP batch jobs or rsync -az --partial --append-verify -e ssh ....

Key Features

Encryption: All data transfers are encrypted using SSH
Authentication: Uses the same authentication mechanisms as SSH (passwords, keys)
Simplicity: Straightforward command-line syntax for basic file transfers
Integration: Typically included with most SSH implementations

Basic SCP Commands

Copy a File from Local to Remote

To copy a file from your local system to a remote server:

scp [options] source_file user@host:destination_path

For example:

scp document.pdf admin@server.example.com:/home/admin/documents/

Copy a File from Remote to Local

To copy a file from a remote server to your local system:

scp [options] user@host:source_file destination_path

For example:

scp admin@server.example.com:/var/log/system.log local-system-log.log

Copy Between Two Remote Systems

SCP can also transfer files directly between two remote systems:

scp [options] user1@host1:source_file user2@host2:destination_path

For example:

scp admin@server1.example.com:/home/admin/file.txt user@server2.example.com:/home/user/

Common SCP Options

Option	Description
`-r`	Recursively copy entire directories
`-p`	Preserve file modification and access times
`-P port`	Specify an alternate port (uppercase P)
`-l limit`	Limit bandwidth used (in Kbit/s)
`-C`	Enable compression during file transfer
`-q`	Quiet mode (suppress progress meter and warnings)
`-v`	Verbose mode (display debugging information)
`-i identity_file`	Specify an identity (private key) file

Examples with Options

Copy Directory Recursively

scp -r /local/directory admin@server.example.com:/remote/path/

Preserve File Attributes

scp -p important.conf admin@server.example.com:/etc/

Use a Non-Standard Port

scp -P 2222 file.txt admin@server.example.com:/home/admin/

Limit Bandwidth Usage

scp -l 1000 large-file.iso admin@server.example.com:/home/admin/

Enable Compression

scp -C large-file.tar.gz admin@server.example.com:/home/admin/

Use Specific Identity File

scp -i ~/.ssh/special_key file.txt admin@server.example.com:/home/admin/

SSH File Transfer Protocol (SFTP)

SFTP is a more feature-rich secure file transfer protocol that also runs over SSH. Unlike SCP, SFTP supports a full range of file operations and is more resilient.

Advantages of SFTP over SCP

Interactive shell: Provides an interactive interface for file operations
Resume capability: Can resume interrupted transfers
Directory listings: View remote directories before transferring
Advanced operations: Rename, delete, create directories, and set permissions
Better error recovery: More robust handling of network issues
File locking: Better support for file locking mechanisms

Using SFTP

Connect to an SFTP Server

sftp [options] user@host

For example:

sftp admin@server.example.com

Interactive SFTP Commands

Once connected to an SFTP server, you'll have access to an interactive shell with commands similar to FTP:

Command	Description	Example
`ls`	List directory contents	`ls /var/log`
`cd`	Change directory	`cd /home/user`
`get`	Download file	`get report.pdf`
`put`	Upload file	`put local-file.txt`
`mget`	Download multiple files	`mget *.txt`
`mput`	Upload multiple files	`mput *.jpg`
`mkdir`	Create directory	`mkdir new-folder`
`rmdir`	Remove directory	`rmdir old-folder`
`rm`	Delete file	`rm unwanted-file.tmp`
`pwd`	Print working directory	`pwd`
`lcd`	Change local directory	`lcd ~/Downloads`
`lls`	List local directory	`lls`
`rename`	Rename file	`rename old.txt new.txt`
`chmod`	Change permissions	`chmod 644 file.txt`
`help`	Display help	`help`
`exit` or `quit`	Exit SFTP	`exit`

Non-Interactive SFTP (Batch Mode)

You can run SFTP in non-interactive mode using a batch file:

sftp -b batch_file.txt user@host

Example batch file content:

cd /remote/directory
get important.pdf
put local-file.txt
quit

SFTP Options

Option	Description
`-b batch_file`	Batch mode using specified file
`-P port`	Connect to specified port
`-i identity_file`	Specify private key file
`-r`	Recursively copy directories
`-v`	Verbose mode
`-C`	Enable compression

SCP vs SFTP: When to Use Which

| Feature | SCP | SFTP | <<<<<<< HEAD | ------- | --- | ---- |

| ------- | --- | --- |

69209624d66ef0c9202860a2e4de1ec159818f6b | Ease of use | Simpler for basic transfers | More complex, but more powerful | | Command-line use | Single command execution | Interactive shell or batch mode | | Resume capability | No | Yes | | Directory operations | Limited (copy only) | Full (list, create, delete) | | Remote file manipulation | No | Yes (rename, change permissions) | | Performance | Generally faster for simple transfers | Might be slower due to protocol overhead | | Error recovery | Limited | More robust | | Platform support | Widely supported | Widely supported |

Security Best Practices

Use Key-Based Authentication: Avoid password authentication when possible
```
scp -i ~/.ssh/id_ed25519 file.txt user@host:/path/
```
Verify Host Fingerprints: Always verify new host keys before accepting them
Use Strong Encryption: Configure SSH to use modern encryption algorithms
Enable Compression for Large Transfers: Use the -C option for better performance
```
scp -C large-file.tar.gz user@host:/path/
```
Limit Bandwidth When Necessary: Use the -l option to avoid network congestion
```
scp -l 2000 backup.tar.gz user@host:/path/
```
Consider Port Forwarding or Jump Hosts for accessing hosts behind firewalls

Troubleshooting Common Issues

Permission Denied

Permission denied (publickey,password)

Solutions:

Verify username and credentials
Check SSH key permissions (should be 600)
Ensure the remote directory is writable

Connection Refused

ssh: connect to host server.example.com port 22: Connection refused

Solutions:

Verify SSH service is running on the remote host
Check firewall settings
Confirm the correct hostname and port

Host Key Verification Failed

Host key verification failed

Solutions:

Verify the new host fingerprint through a trusted out-of-band channel.
If the server's host key has legitimately changed, update your known_hosts file:
```
ssh-keygen -R hostname
```
If unexpected, investigate potential security issues

Graphical SCP/SFTP Clients

For users who prefer graphical interfaces, several clients provide SCP/SFTP functionality:

FileZilla: Cross-platform client with SFTP support
WinSCP: Windows-only client with both SCP and SFTP support
Cyberduck: macOS and Windows client with extensive protocol support
MobaXterm: Windows terminal with integrated SFTP browser

Scripting File Transfers

Automated SCP Transfer

#!/bin/bash
# Script to securely copy log files to a backup server

set -euo pipefail

SOURCE_DIR="/var/log/"
DEST_USER="backup"
DEST_HOST="backup-server.example.com"
DEST_PATH="/backup/logs/$(date +%Y-%m-%d)"

# Create remote directory
ssh "${DEST_USER}@${DEST_HOST}" "mkdir -p '${DEST_PATH}'"

# Copy logs
if scp -r "${SOURCE_DIR}"*.log "${DEST_USER}@${DEST_HOST}:${DEST_PATH}"; then
   echo "Log transfer completed successfully"
else
   echo "Error transferring logs"
fi

SFTP Batch Transfer

#!/bin/bash
# Script to transfer files using SFTP batch mode

set -euo pipefail

# Create temporary batch file
BATCH_FILE=$(mktemp)

cat > "$BATCH_FILE" << EOF
cd /remote/directory
put -r /local/files/*.txt
get -r reports/*.pdf /local/reports/
quit
EOF

# Execute SFTP with batch file
sftp -b "$BATCH_FILE" user@server.example.com

# Clean up
rm -f "$BATCH_FILE"

Table of Contents

Quick Start

Secure Copy Protocol (SCP)

Key Features

Basic SCP Commands

Copy a File from Local to Remote

Copy a File from Remote to Local

Copy Between Two Remote Systems

Common SCP Options

Examples with Options

Copy Directory Recursively

Preserve File Attributes

Use a Non-Standard Port

Limit Bandwidth Usage

Enable Compression

Use Specific Identity File

SSH File Transfer Protocol (SFTP)

Advantages of SFTP over SCP

Using SFTP

Connect to an SFTP Server

Interactive SFTP Commands

Non-Interactive SFTP (Batch Mode)

SFTP Options

SCP vs SFTP: When to Use Which

| Feature | SCP | SFTP | <<<<<<< HEAD | ------- | --- | ---- |

Security Best Practices

Troubleshooting Common Issues

Permission Denied

Connection Refused

Host Key Verification Failed

Graphical SCP/SFTP Clients

Scripting File Transfers

Automated SCP Transfer

SFTP Batch Transfer

Additional Resources