Securely copy files with scp
I have to copy files from machine to machine all the time. Most of the time this copying is done over a network connection. When using that transport method I always like to ensure my copying is being done securely. Fortunately Linux has an app for that (sorry, couldn't resist). That app is scp.
Scp is a part of the secure shell application. If you have installed ssh (secure shell) then you have scp installed on your machine. The only problem with scp is figuring out exactly how to use it. It's not predictable and the man page is absolutely no help. That's where gHacks comes in. In this article you will learn how to securely copy files from one machine to another using scp.
Let's first get out of the way the setup of a test network. We'll use MachineA, with an IP address of 192.168.1.1, for the local machine and MachineB, with an IP address of 192.168.1.2, for the remote machine. Both machines will be Linux machines and both will have ssh installed. For the examples we will be copying the file sample.pdf and the directory /home/jlwallen/TEMP. The username we will use is jlwallen.
The syntax of the scp command is basically:
scp FILENAME USERNAME@ADDRESS_OF_REMOTE_SERVER:FILENAME
One very important issue is that the FILENAME should be the full path to the file to be copied.
Copy file from A to B (While logged into A)
To copy sample.pdf from A to B when you're logged into A issue the command:
scp /home/jlwallen/sample.pdf firstname.lastname@example.org:/home/jlwallen/sample.pdf
You will be prompted for jlwallen's password. Once you enter that password the copy will occur.
Copy file from A to B (While logged into B)
scp email@example.com:/home/jlwallen/sample.pdf /home/jlwallen/sample.pdf
You will be prompted for jlwallen's password.
Copy Directory from A to B(While logged into A)
scp -r /home/jlwallen/TEMP firstname.lastname@example.org:/home/jlwallen/TEMP
You will be prompted for jlwallen's password. This command will copy the entire contents of the TEMP directory.
Copy Director from B to A (While logged into B)
scp -r email@example.com:/home/jlwallen/TEMP /home/jlwallen/TEMP
Pretty simple stuff once you actually know the structure of the command.
Make it passwordless
If you're like me you like to automate things. You can do this with scp but you have to set it up so you can log in without passwords. The best way to do this is by using keys. Here is how it is done:
On the local machine generate a keypair with the following:
ssh-keygen -t rsa
You will accept the defaults and just hit enter. Do not give this a passphrase.
This will generate two files in the ~/.ssh directory: id_rsa and id_rsa.pub. You need to first give your id_rsa the right permissions with the command chmod 700 ~/.ssh/id_rsa. Now you need to copy the id_rsa.pub file over to the server you want to log into. Do this with the command:
scp ~/.ssh/id_rsa.pub 192.168.1.2:~/.ssh/authorized_keys
Now log into the remote machine (via ssh) and make sure the ~/.ssh directory has the right permissions with the command chmod 700 .ssh
The next step is to configure ssh and sshd. On the local machine open up the file /etc/ssh/ssh_config and look for the line:
This line will most likely be commented out. Remove the "#" character and save the file.
Now on the remote machine open up the /etc/ssh/sshd_config file and make sure you have the following lines:
Save that file and restart sshd with the command /etc/rc.d/init.d/sshd restart
Back on the local machine issue the two following commands:
You shouldn't be prompted for a password for the second command.
Now attempt to ssh to the remote machine like so:
You should not be prompted for a password. You are now able to ssh and scp without having to enter a password.
Now that you know how to scp (and do so without user intervention), you can create all sorts of fun automated backup scripts that will backup a local machine to a remote server. There is one warning I will issue: if someone can get your id_rsa file they might be able to get into your machine. So make sure the machine that holds that file is safe.Advertisement